Blocked port 25?

Thu Aug 19 12:58:44 UTC 2004

> 	If I understand you correctly, you are saying that these sites are 
> not able
> to send mail to you. Assuming that they are diverse sites that don't 
> have
> significant similarities, this suggests that the problem is on your 
> end.

In theory, I agree.  But I'm running out of options in my 
troubleshooting and I'm looking for some wisdom from some of the 
experts.

>> From these sites, I
>> can't connect to our mail server, on other sites, I can.
>
> 	I don't understand what this is supposed to mean. It's their mail 
> servers
> that are supposed to try to connect to your mail server.

I understand that.  I have unix account access at one of the sites that 
cannot connect to our mail servers.  I have sent test email, and I have 
tried to telnet to port 25 on the mail server, and the connection times 
out.  I have put a Finisar network analyzer on the ethernet port of our 
border router, and I don't see the traffic even crossing the router.  
We have no firewall, and the access-list is right on the router (we are 
receiving mail from other sites).  What else can I look at?

> 	When you say you can't connect to your server on port 25, where 
> exactly are
> you trying from?

I have a unix account on a server at one of the remote sites that 
cannot send email to NMSU.

>  Did you try emailing (or calling) the administrators of
> those sites?

They just point to me and say "The problem is on your end, fix it."  
Much like you are saying in this email.

>  If you use SPF, are your records valid? Do the senders get any
> bounces?
>

We aren't getting bounces from our mail server. Their mail servers are 
bouncing the messages because the connection to our mail server timed 
out.

> 	Your statement of the problem is lack of specifics. We can't check 
> your SPF
> records. We can't check if those domains have a common provider.

The domains in question do not have a common provider.  We are not 
using SPF.

>  So all we
> can do is tell you to troubleshoot.

I understand that.  Let me restate my request: If anyone on nanog 
cannot send email to nmsu.edu, please send me a tcptraceroute on port 
25 to our mail server.  I need some forensics to help me diagnose this 
problem.  You will have to reply to me at byronhicks at byronhicks.com to 
keep the noise level down on the list.  Thanks in advance for any help 
that I will receive.

--
Byron L. Hicks
Network Engineer
NMSU ICT
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20040819/fdc9af8b/attachment.sig>