503 Bad sequence of commands

Discussion in 'SmarterMail' started by moored99, Jun 30, 2009.

  1. moored99

    moored99 New Member

    I am seeing a lot of 503 Bad sequence of commands

    08:14:38 [193.111.175.42][63822153] rsp: 503 Bad sequence of commands
    09:11:23 [213.212.68.130][57994822] rsp: 503 Bad sequence of commands
    09:25:31 [193.111.175.42][11562536] rsp: 503 Bad sequence of commands
    09:39:09 [203.12.160.61][3237375] rsp: 503 Bad sequence of commands
    10:26:48 [213.212.68.130][49223180] rsp: 503 Bad sequence of commands
    11:39:46 [203.12.160.113][34262252] rsp: 503 Bad sequence of commands
    11:59:42 [203.12.160.113][15837146] rsp: 503 Bad sequence of commands
    12:30:46 [116.50.58.190][38563339] rsp: 503 Bad sequence of commands
    12:30:46 [116.50.58.190][52019121] rsp: 503 Bad sequence of commands
    13:11:25 [203.12.160.101][5946328] rsp: 503 Bad sequence of commands
    13:51:07 [193.111.175.42][66408754] rsp: 503 Bad sequence of commands
    14:00:24 [116.50.57.190][44281669] rsp: 503 Bad sequence of commands
    14:17:07 [203.12.160.182][4076662] rsp: 503 Bad sequence of commands
    14:50:49 [213.212.68.130][4056876] rsp: 503 Bad sequence of commands

    and the incomming email gets rejected by greylisting.

    Any thoughts on how to solve this matter.
  2. PJamie

    PJamie New Member

    Re: 503 Bad sequence of commands

    I don't think there is much you can do.

    I see them a lot on our Mailenable server (which has superb logging) and it's mostly caused by people/servers attempting to relay emails through your server without authenticating first. In our case it is obviously people attempting to spoof the server into sending emails or testing for vulnerabilities and sending instructions that the server doesn't understand or which are not complete. Apart from banning the IP address, or complaining to the IP owner, you might just have to live with it and hope there isn't a known vulnerability in the software they can take advantage of.

    I don't lose any sleep over it but I do keep an eye on it.
  3. moored99

    moored99 New Member

    Re: 503 Bad sequence of commands

    Thank you for your reply the problem is some of these 503 Bad sequence of commands are apearing on legitimate emails and it would seem causing the email to go to Greylisting but the legitimate mail server is not being listed in the Greylisting list.
  4. PJamie

    PJamie New Member

    Re: 503 Bad sequence of commands

    In that case there may be an issue with the sending email server or client. A "bad command" is the sending email server sending a command the email server doesn't accept (e.g. verify), understand (doesn't know what it means) or an incomplete command maybe due to packet loss.

    It will be difficult to find out, but maybe all these senders are using a partcular email client that has issues or maybe they are all from the same company where there is a problem. If you can it might be worth attempting to find some common ground.

    If the email is ultimately being delivered then it isn't an issue but if the email is being greylisted but the IP address isn't being added then this may be an issue with the default behaviour of Smartermail and how it does/doesn't add IP address to the greylisting if the IP address sends a bad command. It might be worth opening a support ticket to found out how Smartermail behaves in this situation.
  5. Kazuma2

    Kazuma2 Member

    Re: 503 Bad sequence of commands

    If you have logging set to full, you should be able to see the commands they send in the SMTP log.
  6. Graf

    Graf New Member

    How do you set loggin to full

    I would like to see the bad commands being logged. how do I set it and view it?

    I am getting a lot of bad commands..