Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm managing a bunch of mail servers, the MX are postfix+amavisd-new systems while the mailboxes are on a qmail+vpopmail box. Yeah, we already plan to move everything to postfix but that's another story (and a long one) :)

Recently I started to see some incoming mails that enter my system with a "delivered-to" (actually in lowercase!) line containing the recipient address. My qmail system sees those headers and bounces the mail thinking it is looping (and I am 110% certain it is not looping).

Those headers are far from my "Received:" lines, seems like there's some kind of SMTP server (maybe actually a transparent smtp proxy?) on the sender's LAN that adds those lines.

I did some investigations and as far as I can tell Delivered-To is not officially covered by any RFC, but it's a de-facto standard used to prevent mail loops. As such, it should not be added by any server other than the one actually delivering the message to the recipient's mailbox. This was also covered on StackOverflow.

If that is correct then those headers I'm getting should be considered a bug of the system that is adding them.

Who is right? Can I tell my users that it is a bug on the sending site and keep enforcing this policy, or should I try to do something on my side to let those messages in?

EDIT: just to clarify, I am only concerned with incoming mail containing a Delivered-To header with an email address that is actually hosted on my system. IE, my system is the "authoritative mailbox" for that address.

EDIT2: I did some more investigation and as far as I can tell those headers gets added by some SMTP service on the sender's side. It is one of those all-in-one linux appliances, acting either as an internal SMTP (actually used by their MUAs) or as a transparent SMTP (where their MUAs think they're talking to an external server but 25/tcp traffic gets intercepted).

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Is this valid e-mail, or is it an attempt to exploit delivered-to 'bouncing'? Is it something like that described here.

Summary:

Notice that delivery address is the same as the Delivered-To address. Next, postfix accepts the message, as being local and for an existing user, and then it immediately sees the Delivered-To header and it decides there is a mail forwarding loop going on and it bounces that message to the forged sender address.

Otherwise, it sounds like someone in the mail chain is incorrectly adding delivered-to headers. Normally, I'd suggest the typical 'be generous in what you accept' approach, but in this case, doing that could lead to mail loops, which is what the header is there to avoid. I'd check first to see if it's not something slightly more sinister, and if it's genuine, I would tell your users it's a bug on the sending site (maybe mail being forwarded by a tool which isn't stripping an existing delivered-to address, i.e. already delivered mail being forwarded).

share|improve this answer
    
It is legitimate incoming mail. But another system on the path (an SMTP-only system, without any actual mailbox on it) is adding a Delivered-To line (actually lowercase'd) containing the address of the recipient's mailbox, and that mailbox is actually hosted on my system. That message when entering my system looks just like a loop (but it isn't). –  Luke404 May 31 '12 at 13:10
    
qmail doesn't actually have any means to turn off Delivered-To loop detection, but even if it had one I wouldn't have used it. It sounds exactly like you are suggesting. –  Luke404 May 31 '12 at 13:14
add comment

A Delivered-To header should be added any time the email is delivered to a mailbox. This can certainly happen more than once. For example, if an email to foo@example.com is remailed to foo-gmail@gmail.com, then the example.com mail server should add a Delivered-to: foo@example.com header to avoid loops in the forwarding. Obviously, that doesn't mean it was delivered to foo-gmail@gmail.com.

So, other sites may have legitimate reasons for adding a Delivered-to header to prevent their own loops. And you should consider the contents of those headers opaque because in general, there's no way for you to know which email addresses they should or should not be delivered to "on the path".

share|improve this answer
    
Problem here is that incoming mail on my system has Delivered-To headers pointing to MY system.That's actually the "avoid loops" mechanism, the only problem is that there isn't any loop and another system (a transparent SMTP proxy on the sender's side, as far as I can tell) is adding those. I edited my question trying to clarify this part. –  Luke404 May 31 '12 at 13:06
    
Good and clear answer for everything but this sentence: "because in general, there's no way for you to know which email addresses they should or should not be delivered to on the path". I do know that email addresses actually residing on my system should not appear in Delivered-To incoming on that very system: that looks like a loop. –  Luke404 May 31 '12 at 13:08
    
@Luke404: Other systems consider them to have already been Delivered-To those addresses. –  David Schwartz May 31 '12 at 18:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.