Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Consider the following junk email received in which the recipient address is the same as the sender's address, but this users didn't send them self the email, it is junk mail;

(All hostnames and IPs have been changed for privacy):

Return-Path: <>
Received: from ( [])
                by (Postfix) with ESMTP id 9F7DB8406E6;
                Thu, 21 Jun 2012 08:11:54 +0100 (BST)
Received: from localhost (localhost [])
                by (Postfix) with ESMTP id 66B6C27C6D1;
                Thu, 21 Jun 2012 08:11:54 +0100 (BST)
X-Virus-Scanned: by Mailplatform Anti-Virus
Received: from ([])
                by localhost ( []) (amavisd-new, port 10024)
                with ESMTP id rOsEgrThepcJ; Thu, 21 Jun 2012 08:11:52 +0100 (BST)
Received: from ( [])
                by (Postfix) with ESMTP id 3AA3127C6C1;
                Thu, 21 Jun 2012 08:11:51 +0100 (BST)
Message-ID: <>
Date: Thu, 21 Jun 2012 08:11:51 +0100
From: <>,
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en; rv: Gecko/20101027 Thunderbird/3.1.6
MIME-Version: 1.0
To: <>,
Subject: Vacancy - apply online
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 120621-0, 21/06/2012), Inbound message
X-Antivirus-Status: Clean

As we can see here, the email was originally submitted to the MX host mx1, by a dial up user (as the reverse PTR records indicates, so a good indication of spam right there!). What I can't understand is why postfix didn't do an SPF lookup, see that the sender isn't an authorised source for this domain (, and adjust the score accordingly. mx1 is the sending and receiving host for the end user's domain "". This was in the postfix logs;

Jun 21 08:11:51 mx1 meta-greylist[4080]: is not in DB 
Jun 21 08:11:51 mx1 meta-greylist[4080]: has_A_or_MX (A): RR A 
Jun 21 08:11:52 mx1 meta-greylist[4080]: SPF result neutral/Please see 
Jun 21 08:11:52 mx1 meta-greylist[4080]: suspect level 0 
Jun 21 08:11:52 mx1 meta-greylist[4080]: set to whitelisted 
Jun 21 08:11:52 mx1 meta-greylist[4080]: action=DUNNO 
Jun 21 08:11:52 mx1 postfix/smtpd[3800]: 3AA3127C6C1:[]
Jun 21 08:11:52 mx1 postfix/trivial-rewrite[3934]: warning: do not list domain in BOTH virtual_alias_domains and relay_domains

Sorry if this seems ridiculous, I'm new to Postfix. If I have not posted something that I obviously should have (piece of a log for example), please let me know, and I will. Thank you.

EDIT-Update: What I meant to say was, did this get through because the sending user has used '' for the return-path value which has somehow thrown off postfix/amavis/spamassassin?

share|improve this question
iirc spam is tagged and handled by spamassassin, are you sure it is running correctly? – Lucas Kauffman Jun 21 '12 at 13:03
I should mentioned I'm also mentioned I'm a bit under the weather at pressent so I'm not thinking strait, yes this server is running spaassassin. I'll check over the config there – jwbensley Jun 21 '12 at 13:07
up vote 3 down vote accepted

well for one postfix isn't a spam detection tool.. it is a MTA. So you need to run some software along with postfix like spamassassin to check for that. Also postfix doesn't check spf automatically, that is something else you have to enable like postfix-policyd-spf-perl in ubuntu for example. Then you have to configure postfix to use that to check.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.