Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a mail server ( on Ubuntu 8.04 LTS which forwards all SMTP traffic to an anti-spam server Many times I see the headers on the anti-spam server to contain from addresses not hosted on the mail server and I have checked and confirmed that my server is not an open relay server. How can a spammer be using my server to relay spam traffic? How can I stop this?

Open relay test:

paddington@paddington-MS-7387:~$ telnet cm 25
Trying 196.201.x.x...
Connected to cm.
Escape character is '^]'.
220 ESMTP Postfix (Ubuntu)
250 2.1.0 Ok
221 2.7.0 Error: I can break rules, too. Goodbye.
Connection closed by foreign host.

A typical headers is:

Received: from ([196.201.x.x])
     by (Postfix) with ESMTPS id 00B601881AD;
     Mon, 27 Aug 2012 14:03:29 +0200 (SAST)
Received: from (localhost [])
    by (Postfix) with ESMTP id 81627367E007;
    Mon, 27 Aug 2012 14:02:50 +0200 (SAST)
Received: from User ( [82.128.x.x])
    by (Postfix) with ESMTP;
    Mon, 27 Aug 2012 14:02:49 +0200 (SAST)
Reply-To: <>
From: "Ms Nkeuri Aguiyi"<>
Subject: Your Unpaid Fund.
Date: Mon, 27 Aug 2012 05:03:22 -0700
MIME-Version: 1.0
Content-Type: text/html;  charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 120821-0, 08/21/2012), Outbound message
X-Antivirus-Status: Clean
Message-Id: <>
To: undisclosed-recipients:;*
share|improve this question
Your telnet conversation is not correct. Try using rcpt to: instead of rcpt and see what happens. – drcelus Aug 31 '12 at 8:38
drcelus, most mailservers will accept the short form of the command, so mail: and rcpt:will give the same result as mail to:and rcpt to:. – Jenny D Aug 31 '12 at 9:55
What I'm missing here is info about what the mailservers do. Are they only for incoming or for outgoing, or for both with limits on who can send where? What do the logs say for this message, in both servers? – Jenny D Aug 31 '12 at 9:58
the CM server is for both incoming and out going mail (SMTP and POP), it forwards all SMTP traffic destined for a domain not residing on itself to our anti spam server (called Cacti) which relays it out. My issue is on my anti spam server I am seeing emails from CM that show headers of domains not hosted on CM. This is a big is worrying since this means someone is relaying spam via my CM server and it is serving domains it does not host. The CM server only servers SMTP for domains resident on it. – Paddington Sep 15 '12 at 11:15

Just because there's a line in the headers which looks as if an SMTP request from is being relayed - that's not necessarily the truth.

If you've got an open web proxy or someone has ssh access to your network then they could easily be relaying these emails from elsewhere - the only difference is that the emails are not entering your network via SMTP.

(this may not be the case here - but checking it should be at the top of your list).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.