Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Over the past two days I've seen a few mysterious email 'bounce' notifications in my inbox. Pasted below is the raw content of one of them. Note that i've censored my own personal details. The to address for all of these messages is

The server in question is an Ubuntu 9.10 box running Apache, Caucho, Resin and a couple other processes unrelated to email. As far as I'm aware it doesn't have postfix installed (which postfix returns nothing).

What steps can I take to properly diagnose and solve the problem?

Received: by with SMTP id iq8cs88533qcb;
        Thu, 5 May 2011 15:41:30 -0700 (PDT)
Received: by with SMTP id cz16mr99495vdb.173.1304635290759;
        Thu, 05 May 2011 15:41:30 -0700 (PDT)
Return-Path: <>
Received: from ([])
        by with ESMTPS id n7si5967804qcu.16.2011.
        (version=TLSv1/SSLv3 cipher=OTHER);
        Thu, 05 May 2011 15:41:29 -0700 (PDT)
Received-SPF: neutral ( is neither permitted nor denied by best guess record for domain of client-ip=;
Authentication-Results:; spf=neutral ( is neither permitted nor denied by best guess record for domain of; dkim=neutral (bad format)
Received: by vxc40 with SMTP id 40so3365116vxc.30
        for <>; Thu, 05 May 2011 15:41:28 -0700 (PDT)
Received: by with SMTP id t20mr703005vco.238.1304635288618;
        Thu, 05 May 2011 15:41:28 -0700 (PDT)
X-Forwarded-For: www@yyy.yyy
Delivered-To: kunnu@yyy.yyy
Received: by with SMTP id fh8cs98486vcb;
        Thu, 5 May 2011 15:41:28 -0700 (PDT)
Received: by with SMTP id l4mr3727970pbp.13.1304635287983;
        Thu, 05 May 2011 15:41:27 -0700 (PDT)
Return-Path: <>
Received: from ( [])
        by with ESMTP id w32si8772572wfd.110.2011.;
        Thu, 05 May 2011 15:41:26 -0700 (PDT)
Received-SPF: pass ( domain of designates as permitted sender) client-ip=;
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;; s=srs;
    h=Sender:List-Id:Date:Message-ID:To:From:Subject:Content-Transfer-Encoding:Content-Type:MIME-Version; bh=/sDnjRTvxfRohXXGvS67I68Cagtj6n4xakYy8dcr218=;
Received: from [2001:4830:20b0:b::3] (port=39583
    by with esmtp (Exim 4.72 #1)
    id 1QI7Ec-0007f0-Fq
    for <kunnu@yyy.yyy>; Thu, 05 May 2011 15:41:26 -0700
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Subject: Your message to silklist awaits moderator approval
To: kunnu@yyy.yyy
Message-ID: <>
Date: Thu, 05 May 2011 15:40:01 -0700
Precedence: bulk
X-Mailman-Version: 2.1.13
List-Id: Intelligent Conversation <>
X-List-Administrivia: yes

Your mail to 'silklist' with the subject


Is being held until the list moderator can review it for approval.

The reason it is being held:

    Post by non-member to a members-only list

Either the message will get posted to the list, or you will receive
notification of the moderator's decision.  If you would like to cancel
this posting, please visit the following URL:
share|improve this question
Have you checked your logs to determine whether or not the original message originates from your system? – Scott Pack May 5 '11 at 23:16
Start by checking your logs like Scott said. Then run an open relay test against your server like this one: – Chris S May 5 '11 at 23:40
up vote 4 down vote accepted

A normal practice of spammers is to use other people's email addresses as the sender. These addresses are harvested in the same way as target addresses. Other than verifying that the messages were not really sent from your system there is nothing you can do about it.

If the messages are being sent from your system then you need to find out who or what is doing the sending and take appropriate actions.

If the messages are being relayed through your system ensure relaying is disabled immediately.

share|improve this answer
As a comment to the masses, when a random user starts getting lots of bounces because the from address is spoofed, we call those messages 'backscatter'. – Scott Pack May 5 '11 at 23:24
thanks. if my server is not running postfix, is there any way that those messages are indeed being relayed through my system? where is the best to start investigating that? – DustMason May 5 '11 at 23:26
@Scott, that comment would have been better posted to the question, as it's not relevant to my answer simply because at this stage we don't know if it's backscatter, a real spammer inside the system or an open relay. – John Gardeniers May 5 '11 at 23:28
@DustMason, is your system running any MTA (not just postfix)? Without an MTA your system cannot be relaying. In that case you need to analyse the message header to determine the path taken. You've edited out just enough information that we cannot do this for you. – John Gardeniers May 5 '11 at 23:31
I can't find any evidence of an MTA running on the server. I guess that would rule out relaying. Thanks for the help. – DustMason May 5 '11 at 23:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.