MoonPoint Support Logo


Shop Amazon Warehouse Deals - Deep Discounts on Open-box and Used ProductsAmazon Warehouse Deals

Advanced Search
Sun Mon Tue Wed Thu Fri Sat

Mon, Aug 20, 2007 11:35 pm

Premature EOM in Sendmail Log File

A user reported that she had been unable to receive email from two email addresses. The server processing her incoming email is running sendmail. When I looked in the /var/log/maillog files, where entries related to successful and unssuccessful email delivery attempts for sendmail are stored, for any entries related to one of the email addresses she mentioned, I did not see any, but I saw many entries similar to the following for the domain name used in that email address, which mentioned collect: unexpected close on connection.

Aug 16 23:37:57 frostdragon sendmail[3738]: l7H3ak69003738: collect: premature EOM: unexpected close
Aug 16 23:37:57 frostdragon sendmail[3738]: l7H3ak69003738: collect: unexpected close on connection from, sender=<>

I had also been receiving reports from others that sending even small messages sometimes takes a long time. A couple of times when I checked the number of SMTP connections to the server with netstat -a | grep smtp | wc -l, I found over 60 connections from other email servers. Previously, I would find that there would usually be no more than a dozen such connections at any give time. And, if I connected to the SMTP port with telnet 25, I would sometimes see fairly slow responses.

In searching for information on the problem, I found Sendmail ‘collect: premature EOM: unexpected close’ solution . The author was encountering the same problem, which he traced to the use of a defunct DNSBL, Like the author, I have been using relays.ordb for a long time to block incoming spam to the server. In the /etc/mail/ file on the server, I have the following line.

FEATURE(`dnsbl', `', `"550 Mail from " $`'&{client_addr} " refused due to sending server misconfiguration - see\#why_rejected"')dnl

I removed the above line from /etc/mail/, but added another DNSBL in its place, the Abusive Hosts Blocking List (AHBL), which I found listed at HOWTO: Sendmail tips for Ensim, by adding the following line to /etc/mail/

FEATURE(dnsbl,`', `"550 Host is on the AHBL - Please see [url][/url]"$&{client_addr}')dnl

I then took the following steps to update sendmail's configuration information so that it no longer checks the blocklist, but uses the AHBL list instead.

  1. I issued the command below

    m4 /etc/mail/ > /etc/mail/

  2. I then stopped and restarted sendmail with the command below

    /etc/init.d/sendmail restart

According to DNS Blacklist is shutting down the DNSBL has been shut down since December 18, 2006. When I tried pinging it, I don't get a response and an nslookup on the name returns an error message as well.

# nslookup
Note:  nslookup is deprecated and may be removed from future releases.
Consider using the `dig' or `host' programs instead.  Run nslookup with
the `-sil[ent]' option to prevent this message from appearing.
;; connection timed out; no servers could be reached

I'm using 5 other blocklists as well, so I checked all of them by pinging them to ensure that no other blocklists that I am using have disappeared. I got responses for all of them, but that just verifies that a system is functioning at the address pinged. To check whether a system is actually functiong as a DNSBL at that address, you should issue use the nslookup, host, or dig commands to query the system using a query in the form All of the commands should result in the address being displayed as the IP address for the query. This is because DNSBL's normally work by storing the IP address of systems to be blocked as reversed mappings so that queries are submitted akin to how you would do a reverse lookup for an query (see Chapter 9: Howto Create a DNSBL (DNS Black List), if you wish further details on how DNSBL's work). Since the convention is for DNSBL's to always have the address in the list, querying for that address allows for easy testing. E.g. for AHBL, I could use with nslookup, host, or dig.

# nslookup
Note:  nslookup is deprecated and may be removed from future releases.
Consider using the `dig' or `host' programs instead.  Run nslookup with
the `-sil[ent]' option to prevent this message from appearing.

Non-authoritative answer:

# host has address

# dig +short

Note: this won't work for all DNSBL's, e.g. performing an nslookup for returns ** server can't find NXDOMAIN, even though the DNSBL is working.

For checking whether a particular IP address is in one of the blacklists, you would reverse the address and then put a period and the name of the blacklist after it when issuing an nslookup, host, or dig query. E.g., if I wanted to find out whether the addresses and are in the Composite Blocking List (CBL), I could use the commands below.

# host has address
# host
Host not found: 3(NXDOMAIN)

From the results, I see that the first address is in the CBL DNSBL, but the second address is not in the blacklist.

Checking other blacklists, aka blocklists, I'm using by querying for the presence of in the lists, I found that is no longer functioning either.

# host
;; connection timed out; no servers could be reached

At OPM status, I learned that has also been shut down. It was shut down in May 2006. Details on the shutdown have been posted at [opm-announce] has shut down.

So I removed the line below from /etc/mail/

FEATURE(`dnsbl', `', `"550 Mail from " $`'&{client_addr} " refused - see"')dnl

After verifying all of the other blacklists I was using in still worked, I then rebuilt the file with the m4 command as above and then restarted sendmail again.


  1. Sendmail ‘collect: premature EOM: unexpected close’ solution
    Posted by plattapuss on February 28th, 2007
    Out of Control Image
  2. DNSBL
    Wikipedia, the free encyclopedia
  3. Abusive Hosts Blocking List
  4. HOWTO: Sendmail tips for Ensim
    Posted By: pblinux
    Posted: December 1, 2003
    The Planet Forums
  5. DNS Blacklist is shutting down
    Article ID: KBID002925
    GFI Knowledge Base
  6. Chapter 9: Howto Create a DNSBL (DNS Black List)
    ZyTrax, Inc.
  7. Composite Blocking List
  8. OPM Status
    Blitzed Wiki
  9. [opm-announce] has shut down
    Posted By: Andy Smith grifferz at
    Posted: May 7, 2006 Mailing Lists

[/network/email/sendmail] permanent link

Once You Know, You Newegg AliExpress by

Shop Amazon Local - Subscribe to Deals in Your Neighborhood

Valid HTML 4.01 Transitional

Privacy Policy   Contact

Blosxom logo