Consider the following junk email received in which the recipient address is the same as the sender's address, but this users didn't send them self the email, it is junk mail;

(All hostnames and IPs have been changed for privacy):

Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: from mx1.mailplatform.net (mx1.mailplatform.net [])
                by mx1.mailplatform.net (Postfix) with ESMTP id 9F7DB8406E6;
                Thu, 21 Jun 2012 08:11:54 +0100 (BST)
Received: from localhost (localhost [])
                by mx1.mailplatform.net (Postfix) with ESMTP id 66B6C27C6D1;
                Thu, 21 Jun 2012 08:11:54 +0100 (BST)
X-Virus-Scanned: by Mailplatform Anti-Virus
Received: from mx1.mailplatform.net ([])
                by localhost (mx1.mailplatform.net []) (amavisd-new, port 10024)
                with ESMTP id rOsEgrThepcJ; Thu, 21 Jun 2012 08:11:52 +0100 (BST)
Received: from dialup.user.some.isp.net (dialup.user.some.isp.net [])
                by mx1.mailplatform.net (Postfix) with ESMTP id 3AA3127C6C1;
                Thu, 21 Jun 2012 08:11:51 +0100 (BST)
Message-ID: <[email protected]>
Date: Thu, 21 Jun 2012 08:11:51 +0100
From: <[email protected]>,
                <[email protected]>,
                <[email protected]>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en; rv: Gecko/20101027 Thunderbird/3.1.6
MIME-Version: 1.0
To: <[email protected]>,
                <[email protected]>,
                <[email protected]>
Subject: Vacancy - apply online
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 120621-0, 21/06/2012), Inbound message
X-Antivirus-Status: Clean

As we can see here, the email was originally submitted to the MX host mx1, by a dial up user (as the reverse PTR records indicates, so a good indication of spam right there!). What I can't understand is why postfix didn't do an SPF lookup, see that the sender isn't an authorised source for this domain (realdomain.com), and adjust the score accordingly. mx1 is the sending and receiving host for the end user's domain "realdomain.com". This was in the postfix logs;

Jun 21 08:11:51 mx1 meta-greylist[4080]: is not in DB 
Jun 21 08:11:51 mx1 meta-greylist[4080]: has_A_or_MX (A): dialup.user.some.isp.net RR A 
Jun 21 08:11:52 mx1 meta-greylist[4080]: SPF result neutral/Please see http://www.openspf.org/[email protected]&ip= 
Jun 21 08:11:52 mx1 meta-greylist[4080]: suspect level 0 
Jun 21 08:11:52 mx1 meta-greylist[4080]: set to whitelisted 
Jun 21 08:11:52 mx1 meta-greylist[4080]: action=DUNNO 
Jun 21 08:11:52 mx1 postfix/smtpd[3800]: 3AA3127C6C1: client=dialup.user.some.isp.net[]
Jun 21 08:11:52 mx1 postfix/trivial-rewrite[3934]: warning: do not list domain readldomain.com in BOTH virtual_alias_domains and relay_domains

Sorry if this seems ridiculous, I'm new to Postfix. If I have not posted something that I obviously should have (piece of a log for example), please let me know, and I will. Thank you.

EDIT-Update: What I meant to say was, did this get through because the sending user has used '[email protected]' for the return-path value which has somehow thrown off postfix/amavis/spamassassin?

  • iirc spam is tagged and handled by spamassassin, are you sure it is running correctly? Jun 21, 2012 at 13:03
  • I should mentioned I'm also mentioned I'm a bit under the weather at pressent so I'm not thinking strait, yes this server is running spaassassin. I'll check over the config there
    – Baldrick
    Jun 21, 2012 at 13:07

1 Answer 1


well for one postfix isn't a spam detection tool.. it is a MTA. So you need to run some software along with postfix like spamassassin to check for that. Also postfix doesn't check spf automatically, that is something else you have to enable like postfix-policyd-spf-perl in ubuntu for example. Then you have to configure postfix to use that to check.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .