Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On my VPS in WebHost Manager I have an area called Mail Queue Manager. I frequently have a few messages built up in there that seem to contain viruses and other problems.

What are these messages, exactly? Are they messages that are attempted to be delivered TO my domain? Or are they messages that somehow are attempted to by sent FROM my domain?

I'm worried that somehow my server is insecure and spammers are using it. Does this message confirm or deny this?

Note: I forward my phil@MYDOMAIN.com to MYGMAIL@gmail.com, and I send mail from Gmail but using my MYDOMAIN.com SMTP servers.

1NbSMG-0005mN-Ul-H
mailnull 47 12
<>
1264915708 0
-ident mailnull
-received_protocol local
-body_linecount 230
-max_received_linelength 80
-allow_unqualified_recipient
-allow_unqualified_sender
-frozen 1264915709
-localerror
XX
1
gullyj@rowzie.com

144P Received: from mailnull by vps.MYDOMAIN.com with local (Exim 4.69)
    id 1NbSMG-0005mN-Ul
    for gullyj@rowzie.com; Sun, 31 Jan 2010 00:28:28 -0500
040  X-Failed-Recipients: MYGMAIL@gmail.com
029  Auto-Submitted: auto-replied
060F From: Mail Delivery System <Mailer-Daemon@vps.MYDOMAIN.com>
022T To: gullyj@rowzie.com
059  Subject: Mail delivery failed: returning message to sender
049I Message-Id: <E1NbSMG-0005mN-Ul@vps.MYDOMAIN.com>
038  Date: Sun, 31 Jan 2010 00:28:28 -0500

1NbSMG-0005mN-Ul-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  MYGMAIL@gmail.com
    (ultimately generated from phil@MYDOMAIN.com)
    SMTP error from remote mail server after end of data:
    host gmail-smtp-in.l.google.com [209.85.221.42]:
    552-5.7.0 Our system detected an illegal attachment on your message. Please
    552-5.7.0 visit http://mail.google.com/support/bin/answer.py?answer=6590 to
    552 5.7.0 review our attachment guidelines. 8si6597260qyk.56

------ This is a copy of the message, including all the headers. ------

Return-path: <gullyj@rowzie.com>
Received: from dyncable-72-159-38-204.bardstown.com ([72.159.38.204])
    by vps.MYDOMAIN.com with esmtp (Exim 4.69)
    (envelope-from <gullyj@rowzie.com>)
    id 1NbSMF-0005kn-3O
    for phil@MYDOMAIN.com; Sun, 31 Jan 2010 00:28:27 -0500
Received: from 72.159.38.204 by mail.rowzie.com; Sun, 31 Jan 2010 00:27:12 -0500
Message-ID: <000d01caa236$0a893ba0$6400a8c0@gullyj>
From: "Erma Cornelius" <phil@MYDOMAIN.com>
To: <phil@MYDOMAIN.com>
Subject: You've received a postcard
Date: Sun, 31 Jan 2010 00:27:12 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
  boundary="----=_NextPart_000_0006_01CAA236.0A893BA0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

This is a multi-part message in MIME format.

------=_NextPart_000_0006_01CAA236.0A893BA0
Content-Type: text/plain;
    format=flowed;
    charset="Windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit

Good day.

Your family member has sent you an ecard

Send free ecards from  with your choice of colors, words and music. 

Your ecard will be available with us for the next 30 days. 

If you wish to keep the ecard longer, you may save it on your computer or take a
print. 

To view your ecard, open zip attached file.

------=_NextPart_000_0006_01CAA236.0A893BA0
Content-Type: application/zip;
    name="ecard.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
    filename="ecard.zip"

(attachment data here)
share|improve this question
add comment

2 Answers

You need to configure your vps's firewall to close port 25 to external traffic.

If you would like to send mail from your webserver you can still do this with port 25 closed to the outside world, preventing 99% of your problems.

If you need an SMTP server for external traffic, use the one the hosting company provides.

Otherwise, you will spend a large majority of time keeping your SMTP server patched and closed to malicious traffic.

share|improve this answer
1  
I suppose since I'm using 465 to send mail then there's no reason to keep 25 open. I still want all my mail to appear as though it's coming from my domain's SMTP. –  philfreo Feb 2 '10 at 14:53
1  
Also, I understand this is a good practice, but I'm really looking for answers to my specific questions also so I can learn. –  philfreo Feb 2 '10 at 14:55
add comment

What are these messages, exactly? Are they messages that are attempted to be delivered TO my domain? Or are they messages that somehow are attempted to by sent FROM my domain?

SPAMmers are relaying emails through your server to outside world. Your email server is configured as an open relay and therefore this is happening.

I'm worried that somehow my server is insecure and spammers are using it. Does this message confirm or deny this?

Server is configured incorrectly and therefore is insecure. However, there is an easy way to fix this:

  1. Run your MTA (Email server) only on Loop back interface (127.0.0.1).
  2. Close port 25 from outside (please note that this is not required at all to send emails).
share|improve this answer
    
Question... is it possible that spammers aren't relaying emails through my server, and, instead that I'm only seeing these messages because I'm forwarding my phil@mydomain.com email to my Gmail address and Gmail isn't accepting the ones with viruses? –  philfreo Feb 3 '10 at 18:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.