Tag Info

New answers tagged

3

The "From" header in the email header can be forged. You can't change that, but the DKIM header allows a machine to sign the content and some headers, and that signature can then be validated against a public key published in dns. Google then adds the "Authentication-Results" header which describes the results of checking that signature. It looks like ...


1

It depends on the distribution a little, but use netstat. I ran a telnet to connect to a Yahoo SMTP server and could then see the connection: telnet mta5.am0.yahoodns.net 25 sudo netstat -anp | grep ':25' I then received this output, which shows telnet as opening the connection: tcp 0 0 192.168.1.25:35053 98.136.217.202:25 ...


1

Your request is bit complicated because this matter. Postfix, by design, will execute something based on positive result from maps. For example in your transport_maps, it will send email to specific host if the recipient has positive result from maps lookup. But, you want to execute something - redirect to another mailbox - if there is negative result from ...


1

This is just local mail, probably from one of your running services or cron jobs. It's addressed to root, but the mail server can't figure out that it's intended to be local mail, because the hostname Ubuntu-1204-precise-64-minimal can't be resolved to an address. To fix this, rename the host to a hostname which resolves to the server's IP address, or add ...


0

If you would like to check if your mail server is an open relay, which can be used to send SPAM, you can use this http://mxtoolbox.com/diagnostic.aspx


1

Perhaps due the earlier configuration error your server had entered in this brilliant Spiral of Notify E-Mail Errors via E-Mail loop. "Hmm, it seems I could not deliver my e-mail... hey, I've got an idea, I'll report about that in an e-mail! Oh, I guess my report about this error did not went through, let me report this error about an error via e-mail...". ...


2

This is reasonable. If a previously parked domain is used to send email, then either the one parking those has lost his nameserver credentials to an evil third party, or the company parking it is using the - possibly previously good - name to deploy more unwanted messages. Keep in mind that the DBL lists not only looks at the actual domains, but also rates ...


2

It's interesting you mention spamassassin, because it has a mode that seems to be exactly what you want (/tmp/spammyin this case contains a single, candidate email): [me@lory tmp]$ spamassassin < /tmp/spammy Oct 20 11:54:47.097 [19986] warn: netset: cannot include 127.0.0.1/32 as it has already been included From: "REDACTED" <redacted> To: ...


0

After doing some research i managed to stop the spam for now. Here are some notes for other users. First of all i had Clamav + Spamassasin running and a valid SPF-record, by the time i posted the problem. Still it wasnt enough. So i changed/altered following settings: postfix - main.cf added: smtpd_helo_required = yes edited: smtpd_helo_restrictions ...


1

I think you need to be sure of what has happened before you take corrective action. You have some indication that a particular user is involved. It may be that the user got phished (or otherwise had their password stolen), in which case your server may not be compromised at all. Analyzing your webserver logs for logons by this user from anomalous source ...


7

Blocking outbound connections to destination TCP port 25 is something that a lot of ISPs do today. While I don't particularly like it, it's a pretty typical thing that gets done. So long as you publish to your users that you're making this change, and perhaps take some packet captures to pre-emptively see who might be effected by the change, I think it's ...


2

While most users should use ports 465 or 587 to drop mails with their providers, you can't be sure of this and there might be many users still use port 25 (e.g. with STARTTLS or even unencrypted).


7

You should never subscribe someone to your list without their permission, which is exactly what you are doing. If that email address does get reactivated, you have no way to know if it is the same person or not. So your email would then be unsolicited, and safely considered spam. If you get a 5xx bounce, you should permanently unsubscribe the address.


0

Adding this as an answer : If your mail server is getting a successful SMTP message out, and recipients aren't receiving it, you must ask the people who own the next-hop mailserver. There is literally no other way for you to find out what that mailserver did with what your server gave them. You can guess all day long, and you should (in general) follow best ...


-3

I believe that there is no issue with the exchange server. Please check for the mail whether it is being moved to Spam in outlook.com. Try adding the exchange server mail id in outlook.com contact and try re sending the mail. If you are thinking that exchange server is prompting false message with out sending mail. The check whether you are able to ping the ...


0

All technical reasons for one or the other solution have already been mentioned with great detail, however there's a (non-technical) point that is missing: when using an hosted anti-spam service, this means that a third party could theoretically read all your incoming e-mails. This is a point you might want to consider. There might be several reasons to ...


0

Don't do that. Mail that already got processed by a third party (Google) is not "real email". Although the content (body) is considered as Spam, the header is manipulated. By forwarding the mail it gets worse: Your anti-spam solution gets trained that all Spam comes from Google. Which is wrong. If it is an off-the-shelf solution, then you can just trust it. ...


4

OK, so after going round and round with Microsoft support on this, I was transferred to someone that was at least willing to help. The first 2 techs stated the list was for "internal use only", but the third person explained that while it is true they don't have access to the actual list, they do state that it was derived from the same sensitive words list ...


2

Seems to be Interspire Email Marketer: https://www.interspire.com/forum/showthread.php?t=16759 http://www.interspire.com/emailmarketer/


5

Microsoft. Microsoft knows what's on the list. They don't publish it. You could open a PSS ticket and ask - have you tried that? Your O365 dashboard makes it easy to open a non-criticals support ticket. Also - even though it's not editable, you can make a transport rule yourself to exempt certain words from being blocked, if you find that to be a problem.


0

Here the complete picture of your email flow Zimbra webmail -> postfix -> amavis -> postfix -> internet Now, your email got stuck in queue because amavisd reject it. Why? Some background Amavisd in zimbra use policy bank to control who can telnet to amavisd daemon. When zimbra initialize configuration after installed, zimbra synchronize ...


4

Are you using DNSBLs? Like Spamhaus or Barracuda's? If not, start there, that'll cut spam down by 90% or more. To enable DNSBLs: On the server, open EMS and run C:\Program Files\Microsoft\Exchange Server\V14\Scripts\install-AntispamAgents.ps1 Run sc stop MSExchangeTransport and sc start MSExchangeTransport Close and reopen EMC or EMS if any are open. In ...


1

What you want to do is simply not possible. Checking for spam at SMTP time forbid this as you would end up at somme point scanning one mail (so one single scan) which will contain multiple recipients... Which user preferences would you load then? In order to do this you need to use a pipe transport (to spamc) at delivery time, not at SMTP time. In any case, ...


0

Take a look at the mail.add_x_header directive in PHP: http://php.net/manual/en/mail.configuration.php#ini.mail.add-x-header It will add an additional mail header with the name of the originating script.


0

We understand that your sever MIGHT have been compromised. Please try the following:- Check the application.cfm and remove any unwanted code added by this attack. Check if there are any unwanted files in your web root or in /CFIDE directory and remove them if present. This means that if there are h.cfm or i.cfm or any other unwanted files present, please ...



Top 50 recent answers are included