Connection Refused messages

[ramsfield]

We have been getting lots of connection refused messages in our mail queue. Here is out setup, our email comes into a dedicated spam box which is running postfix, amavis and spamassasin for processing. (The spam box is Suse Linux 10, 1GB of ram, dual core CPU. The cpu load is less than 1%. The memory is generally only being used about 30% )From there it is sent to our Novell Groupwise email system. Outgoing email is sent directly from the Groupwise box.

Lately, in the last two or three weeks, email is taking longer and longer to move from the postfix queue over to GW. Right now it is well over 2 hours and the queue has thousands of emails all marked with, as an example, connect to mx2.comcast.com[208.17.35.40]: Connection refused. Historically, email would move from the sender, through the spam box, through GW to the recipient in less than 2-3 minutes.

Any ideas as to what is causing the congestion or delay for receiving normal email? Are all the connection refused messages related?

Here is the master.cf:

#
# Postfix master process configuration file. For details on the format
# of the file, see the Postfix master(5) manual page.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - n - 100 smtpd
pickup fifo n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
smtp unix - - n - - smtp
relay unix - - n - - smtp
-o fallback_relay=
showq unix n - n - - showq
error unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
cyrus unix - n n - - pipe
user=cyrus argv=/usr/lib/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
procmail unix - n n - - pipe
flags=R user=nobody argv=/usr/bin/procmail -t -m /etc/procmailrc ${sender} ${recipient}
spamd unix - n n - - pipe
user=spam argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

amavisd-new unix - - y - 4 smtp -o smtp_data_done_timeout=1200 -o disable_dns_lookups=yes

127.0.0.1:10025 inet n - y - - smtpd
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes

And here is the main.cf:

command_directory = /usr/sbin

daemon_directory = /usr/lib/postfix

unknown_local_recipient_reject_code = 550

debug_peer_level = 2

debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
xxgdb $daemon_directory/$process_name $process_id & sleep 5

sendmail_path = /usr/sbin/sendmail

newaliases_path = /usr/bin/newaliases

mailq_path = /usr/bin/mailq

setgid_group = maildrop

html_directory = /usr/share/doc/packages/postfix/html

manpage_directory = /usr/share/man

sample_directory = /usr/share/doc/packages/postfix/samples

readme_directory = /usr/share/doc/packages/postfix/README_FILES
inet_protocols = all
biff = no
mail_spool_directory = /var/mail
canonical_maps = hash:/etc/postfix/canonical
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_alias_domains = hash:/etc/postfix/virtual
relocated_maps = hash:/etc/postfix/relocated
transport_maps = hash:/etc/postfix/transport
sender_canonical_maps = hash:/etc/postfix/sender_canonical
masquerade_exceptions = root
masquerade_classes = envelope_sender, header_sender, header_recipient
myhostname = fenris.co.mason.wa.us
program_directory = /usr/lib/postfix
masquerade_domains =
mydestination = $myhostname, localhost.$mydomain
disable_dns_lookups = no
mailbox_command =
mailbox_transport =
strict_8bitmime = no
disable_mime_output_conversion = no
smtpd_sender_restrictions = hash:/etc/postfix/access
smtpd_client_restrictions =
smtpd_helo_required = yes
smtpd_helo_restrictions =
strict_rfc821_envelopes = yes
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination
smtp_sasl_auth_enable = no
smtpd_sasl_auth_enable = no
smtpd_use_tls = no
smtp_use_tls = no
alias_maps = hash:/etc/aliases
mailbox_size_limit = 0
message_size_limit = 12240000
relay_domains = co.mason.wa.us
content_filter = amavisd-new:[127.0.0.1]:10024
queue_run_delay = 1000s
minimal_backoff_time = 1000s
ipc_idle = 5s
queue_directory = /var/spool/postfix
mail_owner = postfix
data_directory = /var/lib/postfix
inet_interfaces = all
mynetworks_style = subnet
relayhost =
#default_process_limit = 10

 

[aixmurderer]

Without going too much into your setup I would say the GW server (mx2.comcast.com[208.17.35.40]) is probably overloaded, so it's refusing connections (throttling) as it hit a set value of connections at their end.

You can test this manually by doing a "telnet 208.17.35.40 25" and see if you get a connection.

do you have an alternative GW (mx1.comcast.com, mx3., etc) which you can use? In you main.cf you can define a backup relay host to alleviate the problem.

IBM Certified Confused - MQSeries
IBM Certified Flabbergasted - AIX 5 pSeries System Administration
MS Certified Windblows Rebooter

 

[ramsfield]

aixmurderer, I think you misunderstood. The comcast address is an external address. I am guessing that our spam server is trying to bounce a message back to comcast saying the message was underlivable. Our GW server is on the same subnet as our spam box which is on a 10 dot network.