"Detected session with all messages failed" What does it mean?

albatroz

Well-Known Member
Mar 6, 2003
395
5
168
Virtual Orbis / Peru
cPanel Access Level
Root Administrator
Twitter
I noticed several lines like these in my exim_main log file
Does it mean that all of them are spammers and should be blocked?


Code:
2013-06-24 20:56:13 H=server.tcapacitamos.com [198.50.97.130]:57902 Warning: "Detected session with all messages failed"
2013-06-24 20:56:42 H=(231-69-246-190.fibertel.com.ar) [190.246.69.231]:59415 Warning: "Detected session with all messages failed"
2013-06-24 21:05:28 H=s5.xyber.ru [67.212.177.42]:45504 Warning: "Detected session with all messages failed"
2013-06-24 21:06:16 H=(dsldevice.lan) [201.153.188.111]:52896 Warning: "Detected session with all messages failed"
2013-06-24 21:07:59 H=server.tcapacitamos.com [198.50.97.130]:39244 Warning: "Detected session with all messages failed"
2013-06-24 21:08:38 H=24-178-169-177.dhcp.ahvl.nc.charter.com [24.178.169.177]:4977 Warning: "Detected session with all messages failed"
2013-06-24 21:09:41 H=([175.139.169.24]) [175.139.169.24]:4389 Warning: "Detected session with all messages failed"
2013-06-24 21:10:42 H=200-127-196-249.cab.prima.net.ar [200.127.196.249]:35824 Warning: "Detected session with all messages failed"
2013-06-24 21:11:21 H=(customer-XAL-41-104.megared.net.mx) [187.240.41.104]:55776 Warning: "Detected session with all messages failed"
2013-06-24 21:11:59 H=(adsl190-71-15-115.epm.net.co) [190.71.15.115]:2158 Warning: "Detected session with all messages failed"
2013-06-24 21:15:06 H=(Dynamic-IP-19015921882.cable.net.co) [190.159.218.82]:1796 Warning: "Detected session with all messages failed"
2013-06-24 21:15:35 H=server.seminariodecomercioelectronico.com [184.107.180.242]:47248 Warning: "Detected session with all messages failed"
2013-06-24 21:16:16 H=213.37.154.222.static.user.ono.com [213.37.154.222]:1670 Warning: "Detected session with all messages failed"
2013-06-24 21:19:03 H=server.seminariodecomercioelectronico.com [184.107.180.242]:49326 Warning: "Detected session with all messages failed"
2013-06-24 21:20:22 H=recursosexternos2013.com (server.recursosexternos2013.com) [70.38.31.177]:49350 Warning: "Detected session with all messages failed"
2013-06-24 21:20:23 H=mistura2012.com (server.mistura2012.com) [72.55.156.55]:43323 Warning: "Detected session with all messages failed"
2013-06-24 21:20:25 H=(customer-201-117-179-93.uninet-ide.com.mx) [201.117.179.93]:4473 Warning: "Detected session with all messages failed"
2013-06-24 21:24:08 H=server.tcapacitamos.com [198.50.97.130]:51622 Warning: "Detected session with all messages failed"
2013-06-24 21:30:09 H=vps.vps01phsperu.com [192.254.136.254]:48805 Warning: "Detected session with all messages failed"
2013-06-24 21:31:17 H=([10.60.94.3]) [190.239.77.188]:17745 Warning: "Detected session with all messages failed"
2013-06-24 21:31:19 H=([10.60.94.3]) [190.239.77.188]:17746 Warning: "Detected session with all messages failed"
2013-06-24 21:32:13 H=92-247-255-73.spectrumnet.bg [92.247.255.73]:36753 Warning: "Detected session with all messages failed"
2013-06-24 21:32:15 H=92-247-255-73.spectrumnet.bg [92.247.255.73]:36747 Warning: "Detected session with all messages failed"
2013-06-24 21:33:32 H=(static-108-144-5-96.ien.ada.in.ena.net) [96.5.144.108]:63284 Warning: "Detected session with all messages failed"
2013-06-24 21:34:08 H=([10.60.94.3]) [190.239.77.188]:17749 Warning: "Detected session with all messages failed"
2013-06-24 21:34:26 H=server.seminariodecomercioelectronico.com [184.107.180.242]:59187 Warning: "Detected session with all messages failed"
2013-06-24 21:35:04 H=([50.20.221.217]) [50.20.221.217]:54039 Warning: "Detected session with all messages failed"
2013-06-24 21:36:33 H=([10.60.94.3]) [190.239.77.188]:17750 Warning: "Detected session with all messages failed"
2013-06-24 21:36:35 H=([10.60.94.3]) [190.239.77.188]:17751 Warning: "Detected session with all messages failed"
2013-06-24 21:37:49 H=server.seminarioenfinanzas.com [184.107.171.226]:45394 Warning: "Detected session with all messages failed"
2013-06-24 21:40:02 H=150.99.18.95.dynamic.jazztel.es [95.18.99.150]:3324 Warning: "Detected session with all messages failed"
2013-06-24 21:40:23 H=c-76-97-45-185.hsd1.ga.comcast.net [76.97.45.185]:3852 Warning: "Detected session with all messages failed"
2013-06-24 21:43:17 H=([46.184.35.44]) [46.184.35.44]:1174 Warning: "Detected session with all messages failed"
2013-06-24 21:44:13 H=(mail17.improvingsales.info) [190.196.10.30]:38177 Warning: "Detected session with all messages failed"
2013-06-24 21:51:57 H=([10.60.94.3]) [190.239.77.188]:17824 Warning: "Detected session with all messages failed"
2013-06-24 21:53:48 H=([117.206.41.90]) [117.206.41.90]:17118 Warning: "Detected session with all messages failed"
2013-06-24 21:55:10 H=([181.64.201.108]) [181.64.201.108]:61552 Warning: "Detected session with all messages failed"
 

24x7server

Well-Known Member
Apr 17, 2013
1,911
96
78
India
cPanel Access Level
Root Administrator
Twitter
Hello,

I think you have enable " Reject SPF Failures " in your In WHM --> Service Configuration --> Exim Configuration Manager and due to that you are getting these logs in your exim logs file, Please try to disable it and monitor your exim logs
 

albatroz

Well-Known Member
Mar 6, 2003
395
5
168
Virtual Orbis / Peru
cPanel Access Level
Root Administrator
Twitter
You may be right. But it seems that in my case all the blocked servers were spammers :)

Hello,

I think you have enable " Reject SPF Failures " in your In WHM --> Service Configuration --> Exim Configuration Manager and due to that you are getting these logs in your exim logs file, Please try to disable it and monitor your exim logs
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,203
363
Hello :)

The failure messages in the logs you provided stem from the following option under the "ACL Options" tab in "WHM Home » Service Configuration » Exim Configuration Manager":

"Ratelimit incoming connections with only failed recipients"

When enabled, this option will ratelimit incoming SMTP connections that have only sent to failed recipients five separate connection times in the last hour.

Thank you.