Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Alright, I'm tired of spam being sent out from my server. I've installed CSF as a firewall and it keeps on saying Local Host Relay for user

Received: by with SMTP id ep4csp81296igc;
        Tue, 21 Feb 2012 08:07:52 -0800 (PST)
Received: by with SMTP id z36mr5848554wei.22.1329840472165;
        Tue, 21 Feb 2012 08:07:52 -0800 (PST)
Return-Path: <root@myhostname>
Received: from myhostname (myhostname. [])
        by with ESMTPS id p27si18775372weq.52.2012.
        (version=TLSv1/SSLv3 cipher=OTHER);
        Tue, 21 Feb 2012 08:07:52 -0800 (PST)
Received-SPF: pass ( best guess record for domain of root@myhostname designates as permitted sender) client-ip=;
Authentication-Results:; spf=pass ( best guess record for domain of root@myhostname designates as permitted sender) smtp.mail=root@myhostname
Received: from root by myhostname with local (Exim 4.69)
    (envelope-from <root@myhostname>)
    id 1RzsFt-0000LJ-If
    for; Tue, 21 Feb 2012 17:07:53 +0100
Subject: lfd on myhostname: LOCALHOSTRELAY Alert for
From:  <root@myhostname>
Message-Id: <E1RzsFt-0000LJ-If@myhostname>
Date: Tue, 21 Feb 2012 17:07:53 +0100
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - myhostname
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12]
X-AntiAbuse: Sender Address Domain - myhostname
X-Source: /usr/bin/perl
X-Source-Args: lfd - (child) reporting exceeded LOCALHOSTRELAY limit
X-Source-Dir: /etc/csf

Time:  Tue Feb 21 17:07:53 2012 +0100
Type:  LOCALHOSTRELAY, localhost -
Count: 150 emails relayed
Blocked: No

Sample of the first 10 emails:

2012-02-21 17:07:50 1RzsFp-0008VC-QL <= H=localhost (User) [] P=smtp S=1203 T="HELLO" for
2012-02-21 17:07:51 1RzsFq-0008VD-09 <= H=localhost (User) [] P=smtp S=1203 T="HELLO" for
2012-02-21 17:07:51 1RzsFr-0008Vi-4y <= H=localhost (User) [] P=smtp S=1203 T="HELLO" for

I've changed the name of my hostname

Can anyone tell me how I can trace the spam sender ? Thanks.

share|improve this question

2 Answers 2

Just my two cents:

since is connecting to on your server can be a (malicious) script.

Is your server also a webserver? If so, I would check the web directory (directories if using multi/virtual hosts) for suspicious scripts (for example grep for mail() functions within PHP scripts).

Also, if using some sort of webmail interface on the same server it will connect to It could be then that some of your users had the account broken-in (weak passwords?) and the spammers are using those credentials to send spam. If that's the case you should check the webmail logs to know which user(s) send what, not just the smtp server logs.

share|improve this answer
+1 for compromised webmail account –  poke Feb 21 '12 at 17:21

Building on top of @MrShunz answer, if the server is also a webserver it needn't be a malicious script causing this. Bots actively scour the internet for poorly written web forms that send email, for example a feedback form. These can easily be victims of injection attacks which fool the mailserver into sending spam anonymously.

Here is a good discussion of how email injection exploits work, and can be prevented, in PHP forms.

If you do have a webserver on this mailserver, I would recommend you audit all forms and scripts on sites run through this server to see if you have this particular problem. If the server is small and you manage all the sites, you may even know where such forms are.

If you are seeing the spam messages arrive in generic mailboxes ( you might find that there are forms hosted on this server designed to send to these addresses that have been exploited.

share|improve this answer

protected by Michael Hampton Jul 27 '14 at 13:30

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.