Demo
Demo

Knowledge base

PMTA knowledge base›Error code§ 12.6

A virus was found

virus-related
Soft on our axis — check attachments immediately

The receiver considered an attachment or a link malicious.

Response codes — 5.X.X. The category is assigned by a pattern on the receiver’s reply text, not by the code itself: the pattern list can be extended with your own patterns and your own names (bounce-category-patterns).

A rare category that requires attention at once: either a false positive on our markup, or something unwanted really got into the mailing.

A category is an interpretation, not a fact. It was chosen by a pattern that matched the reply text against an expression. The same reply from another receiver may land in another category, and our own pattern would override it altogether. A decision about an address should be built on the receiver’s words, with the category read as a hint.
What the Hub does. It does not count it as hard: our axis is “does the address exist”, and this category is about reputation and content. The address is not removed for it.

The share of such bounces is counted separately — it is the signal for the warm-up scheduler.

Recommended values

What to do with this bounce: check attachments immediately.

Question Answer
what the bounce is about not the address
our axis soft on our axis
will a retry help no

Look at the reply text, not just the category — the cause is in it, while the category only sorts bounces onto shelves.

The assignment to our axis and the recommended action are ours. From the manual come the category’s definition and its response codes.
Example configuration
# the receiver's reply the category is assigned by
550 5.7.1 Message rejected: virus detected
Requires checking immediately: either a false positive, or something unwanted got into the mailing.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Removing an address on a soft bounce

§ 12

What it costsThe mailbox exists, the message just was not accepted right now. Removing the address means losing a live recipient over a temporary cause.
How to spot itAddresses that used to receive messages properly leave the database.
How to do it rightRemove addresses only on bounces that mean the address does not exist. Soft ones are treated with retries and pace.

Raising the rate after the bounces disappear

§ 12

What it costsA soft bounce was a request to slow down. Returning to the previous speed right after the receiver stopped refusing usually leads to the same result a few hours later.
How to spot itBounces from the receiver come back in cycles of roughly equal length.
How to do it rightBring the rate back in steps and watch the bounce share at each one.

Reading the category instead of the reply text

§ 12

What it costsThe category sorts bounces onto shelves, while the cause is written in words. Without the text an investigation stops at “there are many bounces” and goes no further.
How to spot itThe investigation ends with a statement of the bounce share.
How to do it rightLook at the queue’s latest errors — the receiver’s words are there, not their classification.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
⇄

Related entries

1 relation

Applies to

The bounce category in accounting — configurable, not vendor-fixedThe category is assigned by a pattern, and the pattern list can be extended with your own patterns and your own names. § 12.6

How to check on the node
Where this bounce shows up:
pmta show queues --errors example.com
pmtastats bounce-categories --bounceCat virus-related /var/log/pmta/acct-*.csv
The first prints the queue’s recent errors — the receiver’s words are there. The second counts how many bounces fell into this category over the accounting period.
◇

What else to read

3 articles

◇Two inbound report processors and what to do with themBounces by message and complaints are parsed by two identically structured blocks; each has its own address list and its own pair of decisions about the message’s fate.◇A return address with the recipient written into itThe bounce arrives at a unique address, and there is no need to parse its content.◇What to return in a bounce reportWhat to enclose in a bounce report: the whole message or only its headers.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Bounce classification