0

So i've been fighting spam being sent from our server for the past week. We constantly get listed on CBL with rDNS setup and DKIM signatures.

While monitoring the maillog i noticed the following:

Dec 5 12:15:39 aneas postfix/smtp[16934]: A451C2215D7: to=<[email protected]>, relay=none, delay=84394, delays=84394/0.01/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yourdomain.com type=MX: Host not found, try again)

So I ran a cat and grep on the mail log and there are a ton of these entries along with this funky one I noticed too:

Dec 5 21:51:25 aneas postfix/smtpd[6217]: NOQUEUE: reject: RCPT from vxadg-29.srv.cat[46.16.59.162]: 450 4.1.1 <[email protected]>: Recipient address rejected: User unknown in virtual mailbox table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<vxadg-29.srv.cat>

I can't quite make out what is going on here. Could this be the issue? My iptables looks like this:

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -m state --state NEW -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 8891 -m state --state ESTABLISHED -j ACCEPT    
1
  • To find how spam is being sent through your server you will probably be interested in the connect lines in your log. Could you add one of them to your question? Preferably one from just before a spam was injected into the system.
    – Ladadadada
    Dec 5, 2013 at 23:32

1 Answer 1

2

First of all, your iptables config has little bearing on your mail logs.

Dec 5 21:51:25 aneas postfix/smtpd[6217]: NOQUEUE: reject:

Postfix is REJECTING a message.

RCPT from vxadg-29.srv.cat[46.16.59.162]:

It was received from this host/address

450 4.1.1 <[email protected]>: Recipient address rejected: User unknown in virtual mailbox table;

The reason it was rejected. In this case, the user diana in the domain exo-l.com (below) does not exist on your server, but postfix believes it is responsible for delivering mail for the exo-l.com domain so postfix rejects it since it doesn't have anything else it can do with it.

from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<vxadg-29.srv.cat>

The from and to addresses, as well as the protocol it was received via (ESMTP), and how the remote host identified itself vxadg-29.srv.cat

EDIT

Dec 5 12:15:39 aneas postfix/smtp[16934]: A451C2215D7: to=<[email protected]>, relay=none, delay=84394, delays=84394/0.01/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=yourdomain.com type=MX: Host not found, try again)

This log is telling you that a message in the queue was deferred (status-deferred) and the reason (Host or domain name not found). This would usually be a permanent error (bounced), not a temporary error (deferred) so I'm guessing you have soft_bounce=yes in your main.cf file.

4
  • What about the first log entry i posted? What is going on there? There is no from field. I'm trying to hunt down the culprit and a spambot if it's even sending mail from the server
    – Ortix92
    Dec 5, 2013 at 22:37
  • Edited the answer with additional information.
    – fukawi2
    Dec 6, 2013 at 1:59
  • just a quick question: would you know where that [email protected] could be coming from? I looked in the postfix config file but it's not listed there.
    – Ortix92
    Dec 6, 2013 at 8:44
  • I assumed you had censored it, so no, sorry.
    – fukawi2
    Dec 10, 2013 at 7:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .