Questions[barracuda](server)

We are having issues talking to another company. There mails are bouncing back with the error:

#< #5.0.0 X-Spam-Firewall; mail for airinuit.ca loops back to myself> #SMTP#

I have seen this message in relation to configuration issues with PostFix. My environment is Exchange 2010 with a Barracuda Spam & Virus appliance as our mail gateway.

When I looked up the MX record with nslookup I got

> set type=mx
> domain.ca
Server:  mydc.domain.net
Address:  10.10.13.21

Non-authoritative answer:
airinuit.ca     MX preference = 10, mail exchanger = loopback.internic.ca

loopback.internic.ca    internet address = 127.0.0.1

I got the same results from the MXtoolbox. So I guess I understand why my mail gateway thinks it is supposed to send mail to itself. Internic.ca is a CA Registrar.

This does not make sense to me. Even less when I try to email them from my google account and I don't get a bounce back.

What does this mean? I don't think there is an issue on my side but I don't understand why this means.

I have a Barracuda 300, sometime yesterday afternoon, roughly 5:30, the Barracuda stopped delivering external emails to our exchange users and instead, it began marking all those messages as 'deferred' and a reason as 'Invalid Recipient.'

We have had issues with this Barracuda in the past, and normally, just a little reboot and it would eventually start delivering the mail that is in the queue, as of 9:44AM, the mail/log storage is at 75%. The System Load is under <1%, and the firmware storage is at 37%.

I'm looking for other things that I can check, I've exhausted my knowledge on differing things to try, while, not a lot, I've covered the aspects of what I know to check, I'm just not that familiar with the Barracuda prodcuts:

• I can ping our exchange server from the Barracuda
• I've rebooted the Barracuda several times
• A Dig/NsLookup against our exchange server is successful

A part of me just thinks that since the mail/log storage is so large, that it will just take some time before everything is back to normal, but, it's been about three hours so far, and the mail/log storage is slowly growing larger.

The firmware is ridiculously out of date, 4.0.1.009, the powers that be, just don't want to spend the money to update it.

Any help, even if it's just 'be patient, let it do it's thing', would be greatly appreciated.

Thanks.

I have a Barracuda 300. Granted it's running on some old firmware and the Energize updates are quite outdated. I'd like to update them, but, not my financial decision to do so.

Starting around the first of the year, our Barracuda began tagging a rather large amount of emails (that were normally allowed into our network) as SPAM because of a high target score due to it perceiving that the date of said email was 'grossly in the future.'

Here is a copy of the Source of the email taken from the Barracuda.

X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.29990 Rule breakdown below pts rule name description

---

3.38 FH_DATE_PAST_20XX The date is grossly in the future.

Keep in mind, that updating the firmware and applying the Energizer updates at this time is just not feasible. Not that I am guarnateed that that would solve the problem, but, it needs to be taken out of the equation as a possible answer.

I am not that familiar with the inner workings of the Barracuda line of products, does anyone have any idea(s) as to why the Barracuda is thinking that an email sent yesterday at 8:21PM was tagged as a date 'grossly in the future.'

Since the barracudas are so new to me, I'm happy to provide any other information that help suss out what's going on.

Thanks.

J

UPDATE: Outlook Full Header from a tagged message

---

X-ASG-Debug-ID: 1325823247-07a81a820001-d0RUwY

Received: from mail-iy0-f176.google.com (mail-iy0-f176.google.com [209.85.210.176]) by >mail.firstwave.aero with ESMTP id IhB0n11vCN63DDRC for ; Thu, 05 >Jan 2012 22:14:07 -0600 (CST)

X-Barracuda-Envelope-From: [email protected]

Received: by iapp10 with SMTP id p10so2613260iap.21 for ; Thu, 05 Jan 2012 >20:14:07 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=gamma; h=from:to:subject:date:message-id:mime-version:content-type:x-mailer :thread-index:content-language; bh=J9QYd5h7+/IRzvhASN6GQUNYK13b2JGzZnFkRPfE66o=; b=m+Nob2ezR5LLx7bpFzjzIlOwrWURTYpVfcVPWS1IoqHSF3729M9ZPWqImMU+eZP9wK dVeWbiFiv+Pa/9qjrqiqJdoIKeqlVdY2kJQDzijQY81TS0sIQf7Ll+xANRNZ8HdRTXZD kLjviq5cgijZrQAIxEEF0GXjl2cG4boBUbO5I=X-Barracuda-BBL-IP: nil

Received: by 10.50.156.130 with SMTP id we2mr5673047igb.10.1325823247091; Thu, 05 Jan 2012 20:14:07 -0800 (PST) Received: from Joker (deleted IP) by mx.google.com with ESMTPS id l35sm209064912ibj.0.2012.01.05.20.14.05 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 05 Jan 2012 20:14:06 -0800 (PST)

From: me

To: [email protected]

X-ASG-Orig-Subj:

Subject: [Barracuda SPAM]

Date: Thu, 5 Jan 2012 22:14:06 -0600

Message-ID: <000001cccc29$a31db3e0$e9591ba0$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0001_01CCCBF7.588343E0"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: AczMKaF4b0TpPhsDRDOgSYGxa8UwLw==

Content-Language: en-us

X-Barracuda-Connect: mail-iy0-f176.google.com[209.85.210.176]

X-Barracuda-Start-Time: 1325823247

X-Barracuda-URL: deleted

X-Virus-Scanned: by bsmtpd at me.com

X-Barracuda-Spam-Score: 4.68

X-Barracuda-Spam-Status: Yes, SCORE=4.68 using global scores of TAG_LEVEL=3.5

QUARANTINE_LEVEL=1000.0 KILL_LEVEL=5.0 tests=FH_DATE_PAST_20XX, HTML_MESSAGE, >MIME_HTML_MOSTLY, MISSING_SUBJECT, MISSING_SUBJECT_2

X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.29990

Rule breakdown below

pts rule name description

---

3.38 FH_DATE_PAST_20XX The date is grossly in the future.

0.00 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.00 HTML_MESSAGE BODY: HTML included in message

0.01 MISSING_SUBJECT Missing Subject: header

1.28 MISSING_SUBJECT_2 Missing Subject: header

X-Priority: 5 (Lowest)

X-MSMail-Priority: Low

Importance: Low

X-Barracuda-Spam-Flag: YES

Return-Path: [email protected]

X-OriginalArrivalTime: 06 Jan 2012 04:14:08.0496 (UTC) FILETIME=[A2DC1700:01CCCC29]

>

Bit of a formatted mess, but, all there.

Can a Barracuda SF 300 reject mail based on DNS?

Specifically can it respond with a 4XX code for mail claiming to be from a domain without a valid MX or A record (similar to postfix's smtpd_sender_restrictions = reject_unknown_sender_domain).

If so, how do I set it? (I realize it's probably something simple I've overlooked.)

The barracuda can resolve using its configured name servers.
The name servers can correctly resolve external domains.

I'm working with an organization that would like to start using a old Barracuda Spam Filter 300 unit. I've sold and configured plenty of these, but was surprised to see that this unit's warranty lapsed by 6 months. The company was acquired and this equipment came along in the transfer. I called in to Barracuda and was promptly directed to their Warranty and License agreement. In short, they will not renew or extend a warranty on their hardware products to anyone except for the original owner. No exceptions! This means no firmware or virus updates.

A little more probing and I discovered dozens of used Barracuda devices on eBay available for a tiny fraction of the original price because they are ineligible for Barracuda's subscription firmware and updates. This is upsetting, as these units are basically "bricked" from the manufacturer's perspective. The rigid practice of not allowing ownership transfers is ridiculous.

I did find a company, BarracudaPro, that focuses on restoration and repair of these units, but I'm curious if any other admins are running their Barracuda Spam/Web Filters without updates in an unsupported capacity. Any problems? Anything to watch out for?