0

First, I'd like to verify whether or not a spammer is using my server. I've turned logging on -- which logs should I be checking specifically? Just SMTP?

Second, I'd like to configure my domains/hmailserver to play nice with the email world. Is there anything I need to do to any of my domains or to my server settings to make this possible?

My SMTP requires authentication, so I figured that would be enough... but I'm starting to doubt it.

Improve this question
0

4 Answers 4

Reset to default
2

First thing I'd do is check your email logs to see what sort of activity you have.

It is also worth mentioning that just because you have SMTP authentication doesn't mean your server can't be used for spam.

Take a look at "Backscatter spam" as an example:

Wikipedia: Backscatter (email)

Improve this answer
2
  • It would seem that some of my users are getting bounce-backs from other servers regarding a failure to send an email. However, it is clear that my users didn't send any of these messages (clearly spam). Sound like a candidate for backscatter? Thanks!
    – Brian Webster
    Aug 11, 2009 at 5:38
  • 1
    hamlin, if you're getting bounce backs to your users and its clear your user didn't send the message then yes, you're probably a VICTIM of backscatter. You'll have to take a closer look at your mail headers but it sounds like someone else's server is sending out backscatter and your server is accepting the bounced/forged messages because they are addressed to YOUR users. Once again, that's just a guess based on what you told me. You'll have to do some extra digging to determing exactly what is incoming/outgoing from your server.
    – KPWINC
    Aug 11, 2009 at 14:40
3

The easiest thing is to check SMTP, but also enable AWstats. I have not gone to the effort of actually installing AWstats to look at the data, but the text file that is produced by hmailserver is easily understandable.

Also, you may just want to keep the Administrator program open and load status > status and just check the number of processed messages.

However, out of the box, hmailserver is quite good at anti spam. Unless you allow, local domains and ones that you specifically set up a route for are the only ones it allows delivery for.

On top of that, it has pretty good internal anti spam for the mailboxes you host as well - (DNS, SURBL, grey listing and white listing).

So, basically, monitor over the next few days.

I have been using hmailserver for roughly the past 6 months and have not had a problem with spam regarding the out of the box settings - unless you specifically allow something

Improve this answer
3
  • That pretty much says what I would have said. The only extra step I'd take is to write a script to parse the logs and list all senders.
    – John Gardeniers
    Aug 11, 2009 at 0:31
  • I currently have no spam protection enabled. Should I enable the two DNS blacklisting options? zen.spamhaus.org and bl.spamcop.net. There's also the option for SURBL protection, and I have that disabled too. Any thoughts?
    – Brian Webster
    Aug 11, 2009 at 5:40
  • If your clients are reporting little or no spam, it is not worth doing as it does slow down the delivery slightly. However, if you are getting increased amount of spam, I would enable these options.
    – William Hilsum
    Aug 11, 2009 at 11:01
1

Assuming you are using Linux, you should look at the /var/log/maillog file. Plus, I think you shouldn't even be allowing remote SMTP from authenticated users. Only allow that from an internal network or certain ip addresses.

You can check if it is an open relay here: http://www.checkor.com/

Improve this answer
0
1

From the last comment written by you, it seems like your Email server is actually ok. Your users are getting bounce messages because of the following:

  1. They are unwittingly the "From" ID of some Virus/SPAM messages.
  2. The target email system cannot deliver the message.

  3. It bounces the email back to your users (who never sent them).

    If this is the situation, there is precious little you can do in your Email server. There are some technologies you can check out though:

    http://en.wikipedia.org/wiki/Bounce_Address_Tag_Validation

    If you have checked your logs and found that the original messages (to which you receive the bounce message) were not sent through your Email server, the above is most probably the issue.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .