MX REACHABILITY PROBE

If you found 204.11.3.140 or 2001:4ba7:0:50::140 in your mail server
logs, this page explains what it does.


WHAT THIS ADDRESS DOES

It performs MX reachability probes as part of inbound spam filtering.
It never sends mail. It does not deliver, relay, or attempt to relay a
message, and it is not a mail exchanger itself.


WHAT A PROBE LOOKS LIKE

  1. TCP connection to port 25 of a mail exchanger
  2. Read the greeting          (RFC 5321, section 4.2)
  3. Send QUIT                  (RFC 5321, section 4.1.1.10)
  4. Close the connection

There is no EHLO, no MAIL FROM, no RCPT TO and no DATA. No SMTP
transaction takes place. In particular this is NOT sender callout
verification: no recipient address is ever tried, so nothing is probed
that could disclose whether an address exists.

We deliberately send QUIT and wait for the 221 reply instead of dropping
the connection. A silent disconnect would show up in your logs as
"lost connection after CONNECT", which looks like a scan.


WHY

When a message reaches us, we check whether the sending domain can
receive mail at all. A domain that sends but cannot receive is, in
practice, almost always a throwaway registration. The hosts we connect
to are taken from that domain's MX records (RFC 5321, section 5.1).


HOW OFTEN

Results are cached for 24 hours per address. You will therefore see at
most one probe per day per mail exchanger, and only when a message
claiming your domain arrives at our systems. Low mail volume means this
is typically a handful of connections per day in total.


DNS

  204.11.3.140         -> mx-check.postmaster.as34936.net
  2001:4ba7:0:50::140  -> mx-check.postmaster.as34936.net

Both names resolve back to these addresses, so forward-confirmed reverse
DNS holds in either direction.


IF YOU DO NOT WANT THIS

Write to postmaster@as34936.net with the hostname or address of your
mail exchanger and we will exclude it from the check. This is an
operational request rather than an abuse report, and postmaster is the
mailbox for it (RFC 2142, section 2).

If you do consider these connections abusive, abuse@as34936.net is the
contact registered for AS34936 with RIPE (role AAC157-RIPE). Both
mailboxes are read by a person.