Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There seems to be an endless supply of messages in the Qmail maillog for a single address. Can anyone shed some light on why this might be and whether it is a problem? To me it looks like either spam or some sort of unhandled problem. It strikes me as unusual that the 'from=' field is blank. This is on a VPS using Plesk in case that's important.

Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23593]: to=cielofidelidade@cartoes.com
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23586]: from=
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23586]: to=cielofidelidade@cartoes.com
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23585]: from=
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23585]: to=cielofidelidade@cartoes.com
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23584]: from=
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23584]: to=cielofidelidade@cartoes.com
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23583]: from=
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23583]: to=cielofidelidade@cartoes.com
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23600]: from=
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23600]: to=cielofidelidade@cartoes.com
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23599]: from=
Jun 30 15:10:17 vps-1001108-595 qmail-remote-handlers[23599]: to=cielofidelidade@cartoes.com

EDIT Here's a sample of one of the emails:

Received: (qmail 5603 invoked for bounce); 29 Jun 2011 07:46:31 +0100
Date: 29 Jun 2011 07:46:31 +0100
From: MAILER-DAEMON@vps-1001108-595.cp.something.com
To: cielofidelidade@cartoes.com
Subject: failure notice

Hi. This is the qmail-send program at vps-1001108-595.cp.something.com.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<etspetroni@zipmail.com.br>:
200.147.36.13 does not like recipient.
Remote host said: 450 4.7.1 Client host rejected: cannot find your hostname, [XX.XXX.XXX.XXX]
Giving up on 200.147.36.13.
I'm not going to try again; this message has been in the queue too long.

--- Below this line is a copy of the message.

Return-Path: <cielofidelidade@cartoes.com>
Received: (qmail 15585 invoked by uid 48); 22 Jun 2011 07:38:26 +0100
Date: 22 Jun 2011 07:38:26 +0100
Message-ID: <20110622063826.15583.qmail@vps-1001108-595.cp.something.com>
To: etspetroni@zipmail.com.br
Subject: Cadastre-se e Concorra ? um Carro!
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
From: Cielo Fidelidade <cielofidelidade@cartoes.com>


<!DOCTYPE HTML>
<html>
... <body text removed>
<html>  

If I understand this correctly, this is saying that an email sent by my server, from address cielofidelidade@cartoes.com, could not be delivered. However, cielofidelidade@cartoes.com is not a valid email address on my server, so how can email be sent from this address on my server? I have tested whether my server is acting as an open relay, and it isn't. So how else could this be happening? I am getting thousands of these every day. What can I do to prevent it?

share|improve this question
3  
If that is reporting the envelope sender/recipient addresses, then a blank from line is usually indicative of the NULL sender, meaning it's probably a bounced message, which might be an indication that the recipient sent (or was spoofed to have sent) a bunch of undeliverable mail. I think you need to look at more logs before anything can be determined about your situation with any confidence, though. –  Flimzy Jun 30 '11 at 22:22
    
It looks to me like some sort of loop, though. What exactly is qmail-remote-handlers? –  Flimzy Jun 30 '11 at 22:24
    
Yeah I thought it might be some bad config on the server which is just looping a bounced mail internally. I don't know what qmail-remote-handlers is, as far as I know, qmail-remote just handles the delivery of remote mail. –  conorgriffin Jun 30 '11 at 22:29
    
I've never seen qmail-remote in my use of qmail over the years. But there are many qmail add-ons that I'm not familiar with. I don't think qmail-remote-handlers is part of the core system. –  Flimzy Jun 30 '11 at 22:36

2 Answers 2

up vote 0 down vote accepted

In addition to what Flimzy has already pointed out as likely NDRs, this situation may be indicative of an ongoing backscatter attack/outbreak taking place.

share|improve this answer

We had many of these messages in the mail.info log, on our dedicated server (Plesk).

Just before this the SMTP relay was compromised and was used to send out a bit of SPAM. After changing users password and enabling RBL in plesk, these type of messages would still keep displaying in the log.

We just cleared qmails queue: Seems to have stop the messages.

http://dragos.fedorovici.com/plesk-clear-qmail-queue/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.