553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1) : domain, list, my, allowed, rcpthosts

Is this being generated by your server or a remote one?

Is this message in response to a message you are sending or receiving?

09.29.2003 at 08:33PM PDT, ID: 9456455

The domain that you are sending to has been blacklisted by the recipient's email server. It is either because the recipient's email server had received virus from the domain that is blacklisted OR because the recipient's email server had perceived too spam and is blacklisting the sending server.

If your server is blacklisted - you need to call the administrator the other email server and ask him to look at the list for the reason why you are being blacklisted. Yours may be blacklisted because the other server sentry software had automatically blacklisted you.

Check for the fizzer virus on your system as well. It will cause similar situation.

09.29.2003 at 09:47PM PDT, ID: 9456711

I have our exchange server configured correctly to not function as an open relay and there's no way our little company sends enough email to be considered a spammer.

This is in response to email we're sending.

I'll look at the possibility, though. Could it be anything else?

09.29.2003 at 11:07PM PDT, ID: 9457003

Rank: Sage

ikm7176:

error 5.7.1 is generated for the following reasons

-General access denied, sender access deniedthe sender of the message does not have the required permissions necessary to complete delivery.

-You are trying to relay your mail through another SMTP server, and the server does not permit you to relay.

-The recipient may have mailbox delivery restrictions enabled. For example, if a recipients mailbox delivery restriction is set to receive mail from a distribution list only, non-members mail will be rejected and produce this error.

your problem is more related to the relay through another related SMTP server.

09.30.2003 at 04:39AM PDT, ID: 9458408

How is your Exchange server configured to send SMTP mail? Is it using a Smart-Relay host, or is it using DNS to deliver mail?

How long has it been set up this way? Do you have problems with any other domains? Can you tell us the domain name in question?

09.30.2003 at 05:47AM PDT, ID: 9458781

fairoakian,

The problem is that email from your domain to another domain is being blocked, either by an authorized sender domain only list (it sounds like it is) or quarantined domain list (manually by administrator or automatically by detection software) because of virus or spaming relay.

In the virus case, your users may have had or may have an infection. The virus may have used user's address book and send email in volume, or the virus may be using your server as a relay. Best course of action to narrow down the problem is to make a couple of phone calls to admins, whose domain email system is blocking your email. They will be glad to look at their log and tell you if you are blocked and why?

Check your network for virus/worm/trojan such as fizzer, search www.symantec.com for "fizzer" virus/worm/trojan.

09.30.2003 at 07:18AM PDT, ID: 9459474

We're using DNS to deliver mail. The domain in question is allstate.ca. It's been setup this way for years and currently we can send out to everybody except allstate...as far as I can tell.

I've already checked 80% of the network for specific viruses and most of them have virusscan and I have scanmail on the exchange server, so I doubt it's a virus. I'll keep checking though. What does the part about the recipient name not being recognized mean?

09.30.2003 at 07:34AM PDT, ID: 9459611

Basically, you're trying to send a message to user@place, and it doesn't understand place as being allowed on its system. Can you post more of the message that you got indicating the error? I don't think the user part matters, but it might be helpful to see the @place part as well as any more details about the error (including the fully qualified domain of the server and/or ip of the server that is generating the message you put up above).

09.30.2003 at 08:45AM PDT, ID: 9460249

Have you called allstate.ca email admin and ask him/her to check if you are being blocked or his/her DNS mail entry has recently change and that the change has not been propogated yet (up to 72 hours).

09.30.2003 at 01:11PM PDT, ID: 9461868

Thanks for all the replies. I got ahold of their IT department and they confirmed what I've been saying, that we are not banned. So this is something else...anything you think I should check or test that might help illuminate the problem?

09.30.2003 at 03:02PM PDT, ID: 9462411

Please post information relative to the error if you are able. I realize that certain components you might want to edit out for security's sake, but please post what you can.

Also, if you can provide the message headers that are part of the "error" e-mail you got, that might prove useful as well.

09.30.2003 at 03:12PM PDT, ID: 9462467

There's something. The Internet header is blank. It's not getting past our Exchange server apparently.

Here's the undeliverable email in it's entirety with only our domain edited.

The following recipient(s) could not be reached:

Elaine A (E-mail) on 9/30/2003 3:05 PM
The recipient name is not recognized
The MTS-ID of the original message is: c=US;a= ;p=DOMAIN;l=SERVER1-030930220422Z-2212
MSEXCH:IMS:DOMAIN:HR:SERVER2 3553 (000B09AA) 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)

09.30.2003 at 03:27PM PDT, ID: 9462542

Are you sending this message using a POP/SMTP client? Or, are you using Outlook?

I would expect this type of message if you were trying to relay mail through your own server using a SMTP client instead of one like Outlook. The odd part, is that you say you do not have this problem for other domains.

09.30.2003 at 03:34PM PDT, ID: 9462570

Using Outlook. Nothing has changed for a couple months and every other domain I've tested works. Until two days ago, we could send to them with no problem.

09.30.2003 at 11:14PM PDT, ID: 9464054

This isn't an Exchange message, though, is it? Searches for this error message and the phrase "exchange 5.5" have been totally fruitless. This error message almost always accompanies the program QMAIL. Does that mean it can't be my Exchange server?

10.01.2003 at 05:25AM PDT, ID: 9466067

The message you started this thread with is being generated by an Exchange server.

Where does QMail fit into this? Me thinks we need more details again... :)

10.01.2003 at 07:34AM PDT, ID: 9467053

Thanks for clarifying. I'm just puzzled by the lack of information on this error as it pertains to Exchange 5.5. QMail only fits into this because when I search for this error in google all I find is info about Qmail. I was beginning to wonder if this message was coming from Qmail somehow...but I guess not.

10.01.2003 at 07:54AM PDT, ID: 9467217

fariroakian,

"mburdick, where does Qmail fit into this?" (read below)

The message that you posted,
The MTS-ID of the original message is: c=US;a= ;p=DOMAIN;l=SERVER1-030930220422Z-2212
MSEXCH:IMS:DOMAIN:HR:SERVER2 3553 (000B09AA) 553 sorry, that domain isn't <snip> allowed rcpthosts (#5.7.1)

Part 1 comes from your exchange server - Part 2 comes from the other mail server. The explanatory reply is send back and is displayed by your server. It works this way because messages can be customized. You need to contact the admin of the host that sends back the reply to find out why it's rejecting the relay of the domain addressed in your email, especially if you haven't changed anything (such as your smtp address space). The message is from MTS so it's Internet Service to Internet Service communication.

The host server name is the "SERVER2" in your message. It may just be a relay mail server from your ISP and they may be using QMail and such. If you don't know whose email host it belongs to - use tool such as trace router, NSLookup to find the IP address and then track down the owner.

10.01.2003 at 08:33AM PDT, ID: 9467534

I think I found the problem. DNS is messed up somehow. I tried going to www.allstate.ca and got a site called cyberbrowse. same for futureshop.ca. So, somebody has, apparently, hijacked?, the DNS server we use and added their ip addresses to the other companies' domain names. Only scary part is that we're using SBC DNS server addresses.

I had someone not on SBC get the ip address for allstate.ca and now we can see that site internally, but I need to get the ip address of the mail server and mx records and whatnot now.

Am I on the right track? Everybody else see allstate.ca just fine? Ever hear of cyberbrowse?

10.01.2003 at 08:48AM PDT, ID: 9467650

Could be spyware on the machine doing the browsing, could be DNS poisoning, could be DNS hijacking.

You sound like you are definitely on to something...

Accepted Solution

10.01.2003 at 09:06AM PDT, ID: 9467798

Not spyware because it's happening from any computer trying to send mail from our domain (through our exchange server). I know what DNS hijacking is...what's poisoning?

10.01.2003 at 09:20AM PDT, ID: 9467894

http://www.securityfocus.com/guest/17905

They can say it a lot better than I can... :)

10.01.2003 at 10:15AM PDT, ID: 9468275

That was definitly the problem. Got the ip address and host name from allstate and added it internally and the problem is solved. Been trying to let SBC know they've got a DNS attack on their hands, but can't get ahold of anybody.

10.01.2003 at 12:49PM PDT, ID: 9469279