This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Callout Verification not working? v9.607

I am finding that callout verification is not working.   Support will tell me to upgrade to 9.705 first.

Side issue:   Is 9.705 stable enough to justify upgrading?

Configuration:

  • UTM running with SMTP Standard Mode proxy enabled 
  • Domain profile configured for Callout Verification

Failure scenario: 

  • Submitting node connects to UTM and attempts to deliver a message.
  • UTM accepts the message whether or not the user exists in the mail system.  (Callout verification not performed)
  • Submitting system logs a successful delivery.
  • When UTM tries to forward the mesage, it is rejected.   Mail Manager SMTP Log reports bounce status and UTM attempts to send a non-delivery report (NDR).

The whole point of callout verification is to reject messages rather than doing accept-then-NDR.

What should happen:

  • Submitting node connects to UTM and attempts to deliver a message.
  • When UTM receives a recipient identifier, it initiates a test message to the target mail server, to verify that the user exists.  (Whether or not the recipient is valid, the test message initiation connection is immediately closed, since the actual message body is not yet known.)  Failed attempts cause the recipient to be rejected.   The message body is not transmitted from the submitter to UTM until at least one valid recipient is provided. 
  • Submitting system logs a reject status for each rejected recipient.

Can anyone who is running 9.705 indicate whether callout verification is working correctly for you?    Send a message from a remote server to a non-existent address on your server.   If you get a non-delivery report from the the sending domain gateway, then sender verification worked.   If you get a message from the recipient UTM address or no NDR message at all, then UTM is not doing callout verification correctly.



This thread was automatically locked due to age.
Parents
  • I like 9.705, Doug.

    Cheers - Bob

    2020:12:11-10:56:52 secure exim-in[26974]: 2020-12-11 10:56:52 [209.85.210.50] F=<me@gmail.com> R=<asdfgh@mediasoftusa.com> Verifying recipient address with callout
    2020:12:11-10:57:00 secure exim-out[26986]: 2020-12-11 10:57:00 Start queue run: pid=26986
    2020:12:11-10:57:00 secure exim-out[26986]: 2020-12-11 10:57:00 End queue run: pid=26986
    2020:12:11-10:57:06 secure exim-in[26974]: 2020-12-11 10:57:06 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="209.85.210.50" from="me@gmail.com" to="asdfgh@mediasoftusa.com" size="2323" reason="address_verification" extra="Address unknown"
    2020:12:11-10:57:06 secure exim-in[26974]: 2020-12-11 10:57:06 H=mail-ot1-f50.google.com [209.85.210.50]:44885 F=<balfson@gmail.com> rejected RCPT <asdfgh@mediasoftusa.com>: Address unknown

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • I like 9.705, Doug.

    Cheers - Bob

    2020:12:11-10:56:52 secure exim-in[26974]: 2020-12-11 10:56:52 [209.85.210.50] F=<me@gmail.com> R=<asdfgh@mediasoftusa.com> Verifying recipient address with callout
    2020:12:11-10:57:00 secure exim-out[26986]: 2020-12-11 10:57:00 Start queue run: pid=26986
    2020:12:11-10:57:00 secure exim-out[26986]: 2020-12-11 10:57:00 End queue run: pid=26986
    2020:12:11-10:57:06 secure exim-in[26974]: 2020-12-11 10:57:06 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="209.85.210.50" from="me@gmail.com" to="asdfgh@mediasoftusa.com" size="2323" reason="address_verification" extra="Address unknown"
    2020:12:11-10:57:06 secure exim-in[26974]: 2020-12-11 10:57:06 H=mail-ot1-f50.google.com [209.85.210.50]:44885 F=<balfson@gmail.com> rejected RCPT <asdfgh@mediasoftusa.com>: Address unknown

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data