I have a question about exim_mainlog.

I am currently investigating a server that was used to send out spam. The log is full of messages (about 12 per min) that read;

2012-04-04 11:42:55 1SFNfz-0005Nv-EN => user R=localuser T=local_delivery

I have omitted the domain and user.

Does this log indicate that this server is not sending mail, but receiving mail from some other source?

  • Could you provide more information about this message? Try exigrep 1SFNfz-0005Nv-EN /path/to/mainlog command and please show us the results. – kupson Apr 4 '12 at 16:11

That log means that the message ID 1SFNfz-0005Nv-EN was routed through the localuser router and ultimately delivered via the local_delivery transport.

Without looking at your config in detail, it's impossible to know what exactly happened, but unless you've changed a lot, it's fairly safe to say that the mail was sent to user@example.com where user is an actual user on your mailserver, and example.com is a local domain for exim to deliver to.

  • So is it possible that these logs indicate that the server is being used to send spam. I have some header information from an individual email; Envelope-to: user @ box3. domain .com Received: from mailnull by box3 . domain .com with local (Exim 4.69) for user @ box3. domain .com; Tue, 27 Mar 2012 15:56:28 +0100 From: Mail Delivery System <Mailer-Daemon@box3. domain .com> To: user @ box3. domain .com I know it's prob not the case, but it looks as if the server is sending mail to itself? – Optix App Development Apr 4 '12 at 12:46
  • If it's not routing any mail out to the outside world via the SMTP transport, it's not delivering spam to anyone. The log you've provided says it's delivering mail locally only. – growse Apr 4 '12 at 13:01
  • I see. I'm right in thinking that even if it is not reaching the outside world, this is not normal mail server behaviour? – Optix App Development Apr 4 '12 at 13:29
  • It depends on how you're defining 'normal mail server behaviour'. You've configured exim to deliver any mail to a valid user at a domain that exim considers 'local' to a local mailbox. Your mailserver is receiving emails that fit that description. Either you do want local mail to be delivered locally, in which case it's working as expected, or you don't, in which case you've configured it wrong. – growse Apr 4 '12 at 14:03
  • Ok. I can see what this means now. Truth is, I'm not really a server admin and I'm trying hard to find a way of telling whether my server is sending out spam. All that these logs tell me is that emails were bounced back to me, not where they originated. :( Thanks for your help btw. – Optix App Development Apr 4 '12 at 14:43

No. That only indicate, that incoming message have been successfully delivered into mailbox.

Exim logs host that have initiated SMTP-session, not those have originated the message. Headers may contain chain of relays including the very first, but headers may be forged.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.