Discussion:
MAIL/RCPT/RSET sequence triggers "too many errors"
(too old to reply)
c***@gmail.com
2018-10-18 12:11:53 UTC
Permalink
Hello,

I've got a strange issue with a customer which has raised a couple of questions. The first isn't strictly Postfix related, although it's the cause of the second question and explains what's going on.

The disconnect log from one of their sessions looks like the following (74 separate emails sent) -

disconnect from unknown ehlo=1 auth=1 mail=148 rcpt=148 data=74 rset=75 quit=1 commands=448

Now the interesting thing to note is that it sends twice as many mail/rcpt commands as data, and 75 resets. This is because the client sends MAIL/RCPT/RSET once for each email, then does another RSET for good luck, then does a full MAIL/RCPT/DATA sequence for each email.

First question is has anyone seen anything like this? Client is apparently Outlook - and the emails do have a 'X-Mailer: Microsoft Outlook 14.0' header - so I'm generally ruling out my first thought of a dodgy client. I'm wondering if there's some sort of AV that could do this?

Anyway the second question is that in some cases, the log looks like this -

disconnect from unknown ehlo=1 auth=1 mail=120 rcpt=120 rset=120 commands=362

In this case it tried to send 120 emails, but on the 121st MAIL command, got kicked off with a 'too many errors' message. No errors are reported in the smtp connection, and nothing appears in the log other than the final "too many errors".

Can someone tell me what error Postfix is triggering here, and why it gets to 120 before finally giving up? All my limits are standard so soft limit should be 10. It also ends on a "MAIL" command (same one it's already sent successfully 120 times), and I don't see any rejected addresses which rules out my theory that it eventually builds up to a certain number of rejected recipients.

Obviously this appears to be a client problem but it would be useful to know exactly why Postfix gives up at this point.

Thanks for any help,
Matt
c***@gmail.com
2018-10-18 13:27:06 UTC
Permalink
Post by c***@gmail.com
Hello,
I've got a strange issue with a customer which has raised a couple of questions. The first isn't strictly Postfix related, although it's the cause of the second question and explains what's going on.
The disconnect log from one of their sessions looks like the following (74 separate emails sent) -
disconnect from unknown ehlo=1 auth=1 mail=148 rcpt=148 data=74 rset=75 quit=1 commands=448
Now the interesting thing to note is that it sends twice as many mail/rcpt commands as data, and 75 resets. This is because the client sends MAIL/RCPT/RSET once for each email, then does another RSET for good luck, then does a full MAIL/RCPT/DATA sequence for each email.
First question is has anyone seen anything like this? Client is apparently Outlook - and the emails do have a 'X-Mailer: Microsoft Outlook 14.0' header - so I'm generally ruling out my first thought of a dodgy client. I'm wondering if there's some sort of AV that could do this?
Anyway the second question is that in some cases, the log looks like this -
disconnect from unknown ehlo=1 auth=1 mail=120 rcpt=120 rset=120 commands=362
In this case it tried to send 120 emails, but on the 121st MAIL command, got kicked off with a 'too many errors' message. No errors are reported in the smtp connection, and nothing appears in the log other than the final "too many errors".
Can someone tell me what error Postfix is triggering here, and why it gets to 120 before finally giving up? All my limits are standard so soft limit should be 10. It also ends on a "MAIL" command (same one it's already sent successfully 120 times), and I don't see any rejected addresses which rules out my theory that it eventually builds up to a certain number of rejected recipients.
Obviously this appears to be a client problem but it would be useful to know exactly why Postfix gives up at this point.
Thanks for any help,
Matt
Managed to figure out the answer to the second question. The hard error limit defaults to 20, and "junk commands (NOOP, VRFY, ETRN or RSET)" don't start raising the error count until they hit "smtpd_junk_command_limit" which defaults to 100.

Still not sure why the client is sending the commands in this way though.

Matt
Burkhard Ott
2018-10-18 17:09:49 UTC
Permalink
Post by c***@gmail.com
The disconnect log from one of their sessions looks like the following
(74 separate emails sent) -
disconnect from unknown ehlo=1 auth=1 mail=148 rcpt=148 data=74 rset=75 quit=1 commands=448
Actually it's 148, data is your mailbody.
Post by c***@gmail.com
Now the interesting thing to note is that it sends twice as many
mail/rcpt commands as data, and 75 resets. This is because the client
sends MAIL/RCPT/RSET once for each email, then does another RSET for
good luck, then does a full MAIL/RCPT/DATA sequence for each email.
I have only see that behaviour from spammers.
Post by c***@gmail.com
First question is has anyone seen anything like this? Client is
apparently Outlook - and the emails do have a 'X-Mailer: Microsoft
Outlook 14.0' header - so I'm generally ruling out my first thought of a
dodgy client. I'm wondering if there's some sort of AV that could do
this?
I'm not sure about AV, can you test a different MUA on that host?
c***@gmail.com
2018-10-19 08:32:39 UTC
Permalink
Post by Burkhard Ott
Post by c***@gmail.com
The disconnect log from one of their sessions looks like the following
(74 separate emails sent) -
disconnect from unknown ehlo=1 auth=1 mail=148 rcpt=148 data=74 rset=75
quit=1 commands=448
Actually it's 148, data is your mailbody.
Not sure what you're getting at here. The user only had 74 emails to send, and only 74 were actually accepted and delivered by the server. The reason it shows 148 is, as detailed below, the client sends a useless mail/rcpt
sequence for every email, then starts again, sending 148 "MAIL FROM" commands in total.
Post by Burkhard Ott
Post by c***@gmail.com
Now the interesting thing to note is that it sends twice as many
mail/rcpt commands as data, and 75 resets. This is because the client
sends MAIL/RCPT/RSET once for each email, then does another RSET for
good luck, then does a full MAIL/RCPT/DATA sequence for each email.
I have only see that behaviour from spammers.
Post by c***@gmail.com
First question is has anyone seen anything like this? Client is
apparently Outlook - and the emails do have a 'X-Mailer: Microsoft
Outlook 14.0' header - so I'm generally ruling out my first thought of a
dodgy client. I'm wondering if there's some sort of AV that could do
this?
I'm not sure about AV, can you test a different MUA on that host?
I'll see if I can get them to try that.

Loading...