0

On my VPS in WebHost Manager I have an area called Mail Queue Manager. I frequently have a few messages built up in there that seem to contain viruses and other problems.

What are these messages, exactly? Are they messages that are attempted to be delivered TO my domain? Or are they messages that somehow are attempted to by sent FROM my domain?

I'm worried that somehow my server is insecure and spammers are using it. Does this message confirm or deny this?

Note: I forward my [email protected] to [email protected], and I send mail from Gmail but using my MYDOMAIN.com SMTP servers.

1NbSMG-0005mN-Ul-H
mailnull 47 12
<>
1264915708 0
-ident mailnull
-received_protocol local
-body_linecount 230
-max_received_linelength 80
-allow_unqualified_recipient
-allow_unqualified_sender
-frozen 1264915709
-localerror
XX
1
[email protected]

144P Received: from mailnull by vps.MYDOMAIN.com with local (Exim 4.69)
    id 1NbSMG-0005mN-Ul
    for [email protected]; Sun, 31 Jan 2010 00:28:28 -0500
040  X-Failed-Recipients: [email protected]
029  Auto-Submitted: auto-replied
060F From: Mail Delivery System <[email protected]>
022T To: [email protected]
059  Subject: Mail delivery failed: returning message to sender
049I Message-Id: <[email protected]>
038  Date: Sun, 31 Jan 2010 00:28:28 -0500

1NbSMG-0005mN-Ul-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  [email protected]
    (ultimately generated from [email protected])
    SMTP error from remote mail server after end of data:
    host gmail-smtp-in.l.google.com [209.85.221.42]:
    552-5.7.0 Our system detected an illegal attachment on your message. Please
    552-5.7.0 visit http://mail.google.com/support/bin/answer.py?answer=6590 to
    552 5.7.0 review our attachment guidelines. 8si6597260qyk.56

------ This is a copy of the message, including all the headers. ------

Return-path: <[email protected]>
Received: from dyncable-72-159-38-204.bardstown.com ([72.159.38.204])
    by vps.MYDOMAIN.com with esmtp (Exim 4.69)
    (envelope-from <[email protected]>)
    id 1NbSMF-0005kn-3O
    for [email protected]; Sun, 31 Jan 2010 00:28:27 -0500
Received: from 72.159.38.204 by mail.rowzie.com; Sun, 31 Jan 2010 00:27:12 -0500
Message-ID: <000d01caa236$0a893ba0$6400a8c0@gullyj>
From: "Erma Cornelius" <[email protected]>
To: <[email protected]>
Subject: You've received a postcard
Date: Sun, 31 Jan 2010 00:27:12 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
  boundary="----=_NextPart_000_0006_01CAA236.0A893BA0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

This is a multi-part message in MIME format.

------=_NextPart_000_0006_01CAA236.0A893BA0
Content-Type: text/plain;
    format=flowed;
    charset="Windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit

Good day.

Your family member has sent you an ecard

Send free ecards from  with your choice of colors, words and music. 

Your ecard will be available with us for the next 30 days. 

If you wish to keep the ecard longer, you may save it on your computer or take a
print. 

To view your ecard, open zip attached file.

------=_NextPart_000_0006_01CAA236.0A893BA0
Content-Type: application/zip;
    name="ecard.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
    filename="ecard.zip"

(attachment data here)
Improve this question

2 Answers 2

Reset to default
2

You need to configure your vps's firewall to close port 25 to external traffic.

If you would like to send mail from your webserver you can still do this with port 25 closed to the outside world, preventing 99% of your problems.

If you need an SMTP server for external traffic, use the one the hosting company provides.

Otherwise, you will spend a large majority of time keeping your SMTP server patched and closed to malicious traffic.

Improve this answer
2
  • 1
    I suppose since I'm using 465 to send mail then there's no reason to keep 25 open. I still want all my mail to appear as though it's coming from my domain's SMTP.
    – philfreo
    Feb 2, 2010 at 14:53
  • 1
    Also, I understand this is a good practice, but I'm really looking for answers to my specific questions also so I can learn.
    – philfreo
    Feb 2, 2010 at 14:55
1

What are these messages, exactly? Are they messages that are attempted to be delivered TO my domain? Or are they messages that somehow are attempted to by sent FROM my domain?

SPAMmers are relaying emails through your server to outside world. Your email server is configured as an open relay and therefore this is happening.

I'm worried that somehow my server is insecure and spammers are using it. Does this message confirm or deny this?

Server is configured incorrectly and therefore is insecure. However, there is an easy way to fix this:

  1. Run your MTA (Email server) only on Loop back interface (127.0.0.1).
  2. Close port 25 from outside (please note that this is not required at all to send emails).
Improve this answer
2
  • 1
    Question... is it possible that spammers aren't relaying emails through my server, and, instead that I'm only seeing these messages because I'm forwarding my [email protected] email to my Gmail address and Gmail isn't accepting the ones with viruses?
    – philfreo
    Feb 3, 2010 at 18:41
  • Yes, that's another possibility. This kind of errors also happen if you don't have spam filter on VPS or it leaks some of insecure spam and then your server tries to forward that to gmail. Especially if your mail server on VPS accepts emails with spoofed domain - then gmail will surely return that mail to your server and your server doesn't have spoofed mailbox so it will stuck in queue.
    – Zbyszek
    Sep 15, 2016 at 14:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .