Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Over the past two days I've seen a few mysterious email 'bounce' notifications in my inbox. Pasted below is the raw content of one of them. Note that i've censored my own personal details. The to address for all of these messages is kunnu@mydomain.com.

The server in question is an Ubuntu 9.10 box running Apache, Caucho, Resin and a couple other processes unrelated to email. As far as I'm aware it doesn't have postfix installed (which postfix returns nothing).

What steps can I take to properly diagnose and solve the problem?

Delivered-To: zzz@xxx.xxx
Received: by 10.229.225.8 with SMTP id iq8cs88533qcb;
        Thu, 5 May 2011 15:41:30 -0700 (PDT)
Received: by 10.52.94.48 with SMTP id cz16mr99495vdb.173.1304635290759;
        Thu, 05 May 2011 15:41:30 -0700 (PDT)
Return-Path: <hello+caf_=zzz=xxx.xxx@yyy.yyy>
Received: from mail-vx0-f171.google.com ([209.85.220.171])
        by mx.google.com with ESMTPS id n7si5967804qcu.16.2011.05.05.15.41.28
        (version=TLSv1/SSLv3 cipher=OTHER);
        Thu, 05 May 2011 15:41:29 -0700 (PDT)
Received-SPF: neutral (google.com: 209.85.220.171 is neither permitted nor denied by best guess record for domain of hello+caf_=zzz=xxx.xxx@yyy.yyy) client-ip=209.85.220.171;
Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.220.171 is neither permitted nor denied by best guess record for domain of hello+caf_=zzz=xxx.xxx@yyy.yyy) smtp.mail=hello+caf_=zzz=xxx.xxx@yyy.yyy; dkim=neutral (bad format) header.i=@lists.hserus.net
Received: by vxc40 with SMTP id 40so3365116vxc.30
        for <zzz@xxx.xxx>; Thu, 05 May 2011 15:41:28 -0700 (PDT)
Received: by 10.220.105.148 with SMTP id t20mr703005vco.238.1304635288618;
        Thu, 05 May 2011 15:41:28 -0700 (PDT)
X-Forwarded-To: zzz@xxx.xxx
X-Forwarded-For: www@yyy.yyy zzz@xxx.xxx
Delivered-To: kunnu@yyy.yyy
Received: by 10.220.203.72 with SMTP id fh8cs98486vcb;
        Thu, 5 May 2011 15:41:28 -0700 (PDT)
Received: by 10.68.54.196 with SMTP id l4mr3727970pbp.13.1304635287983;
        Thu, 05 May 2011 15:41:27 -0700 (PDT)
Return-Path: <silklist-bounces+kunnu=yyy.yyy@lists.hserus.net>
Received: from frodo.hserus.net (frodo.hserus.net [204.74.68.40])
        by mx.google.com with ESMTP id w32si8772572wfd.110.2011.05.05.15.41.26;
        Thu, 05 May 2011 15:41:26 -0700 (PDT)
Received-SPF: pass (google.com: domain of silklist-bounces+kunnu=yyy.yyy@lists.hserus.net designates 204.74.68.40 as permitted sender) client-ip=204.74.68.40;
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.hserus.net; s=srs;
    h=Sender:List-Id:Date:Message-ID:To:From:Subject:Content-Transfer-Encoding:Content-Type:MIME-Version; bh=/sDnjRTvxfRohXXGvS67I68Cagtj6n4xakYy8dcr218=;
    b=otS4U0mrs56TlFehbxm530tNBxnHi4ty2qhoU6phY3JE4NXddCPCPC4DhYyprKPjcr6odZvuv/LU3Rp5CWFfx9zajBlXIVYbJaAOKGpkQsHHSvK+QWm/mfe7hsv0omRQsZzQ/u7wIgaZ/xq6xq1ZJ7s79lg9HUUifCbu4WQ9l30=;
Received: from [2001:4830:20b0:b::3] (port=39583 helo=frodo.hserus.net)
    by frodo.hserus.net with esmtp (Exim 4.72 #1)
    id 1QI7Ec-0007f0-Fq
    for <kunnu@yyy.yyy>; Thu, 05 May 2011 15:41:26 -0700
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Subject: Your message to silklist awaits moderator approval
From: silklist-bounces@lists.hserus.net
To: kunnu@yyy.yyy
Message-ID: <mailman.2407.1304635201.1969.silklist@lists.hserus.net>
Date: Thu, 05 May 2011 15:40:01 -0700
Precedence: bulk
X-BeenThere: silklist@lists.hserus.net
X-Mailman-Version: 2.1.13
List-Id: Intelligent Conversation <silklist.lists.hserus.net>
X-List-Administrivia: yes
Sender: silklist-bounces+kunnu=yyy.yyy@lists.hserus.net
Errors-To: silklist-bounces+kunnu=yyy.yyy@lists.hserus.net

Your mail to 'silklist' with the subject

    ??????????.........

Is being held until the list moderator can review it for approval.

The reason it is being held:

    Post by non-member to a members-only list

Either the message will get posted to the list, or you will receive
notification of the moderator's decision.  If you would like to cancel
this posting, please visit the following URL:

    http://lists.hserus.net/mailman/confirm/silklist/2a4fa5a64a95b7109163b7f78731fbd3d236be13
share|improve this question
2  
Have you checked your logs to determine whether or not the original message originates from your system? –  Scott Pack May 5 '11 at 23:16
    
Start by checking your logs like Scott said. Then run an open relay test against your server like this one: abuse.net/relay.html –  Chris S May 5 '11 at 23:40

1 Answer 1

up vote 4 down vote accepted

A normal practice of spammers is to use other people's email addresses as the sender. These addresses are harvested in the same way as target addresses. Other than verifying that the messages were not really sent from your system there is nothing you can do about it.

If the messages are being sent from your system then you need to find out who or what is doing the sending and take appropriate actions.

If the messages are being relayed through your system ensure relaying is disabled immediately.

share|improve this answer
    
As a comment to the masses, when a random user starts getting lots of bounces because the from address is spoofed, we call those messages 'backscatter'. –  Scott Pack May 5 '11 at 23:24
    
thanks. if my server is not running postfix, is there any way that those messages are indeed being relayed through my system? where is the best to start investigating that? –  DustMason May 5 '11 at 23:26
    
@Scott, that comment would have been better posted to the question, as it's not relevant to my answer simply because at this stage we don't know if it's backscatter, a real spammer inside the system or an open relay. –  John Gardeniers May 5 '11 at 23:28
    
@DustMason, is your system running any MTA (not just postfix)? Without an MTA your system cannot be relaying. In that case you need to analyse the message header to determine the path taken. You've edited out just enough information that we cannot do this for you. –  John Gardeniers May 5 '11 at 23:31
    
I can't find any evidence of an MTA running on the server. I guess that would rule out relaying. Thanks for the help. –  DustMason May 5 '11 at 23:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.