So i've been fighting spam being sent from our server for the past week. We constantly get listed on CBL with rDNS setup and DKIM signatures.
While monitoring the maillog i noticed the following:
Dec 5 12:15:39 aneas postfix/smtp[16934]: A451C2215D7: to=<[email protected]>, relay=none, delay=84394, delays=84394/0.01/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yourdomain.com type=MX: Host not found, try again)
So I ran a cat and grep on the mail log and there are a ton of these entries along with this funky one I noticed too:
Dec 5 21:51:25 aneas postfix/smtpd[6217]: NOQUEUE: reject: RCPT from vxadg-29.srv.cat[46.16.59.162]: 450 4.1.1 <[email protected]>: Recipient address rejected: User unknown in virtual mailbox table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<vxadg-29.srv.cat>
I can't quite make out what is going on here. Could this be the issue? My iptables looks like this:
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -m state --state NEW -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 8891 -m state --state ESTABLISHED -j ACCEPT
connect
lines in your log. Could you add one of them to your question? Preferably one from just before a spam was injected into the system.