3

Awhile ago I noticed that email messages from my domain is not immediately delivers by google, and I'm getting an smtp error message from google server. I don not remember the exact wording of that message but googling it, suggested that I need to setup SPF and DKIP records. Which I did. It resolved the issue with google not accepting emails. However now, a few weeks later it opened a flood gate of returned emails. Below is one example where I substituted my domain name to mydomain.com

Return-Path: <MAILER-DAEMON>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on ip-172-31-14-136
X-Spam-Level: 
X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED,
  DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,
  RCVD_IN_MSPIKE_WL,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0
Delivered-To: andrews@mydomain.com
Received: from mail-wg0-f68.google.com (mail-wg0-f68.google.com [74.125.82.68])
  by service.mydomain.com (Postfix) with ESMTPS id B2D5C3CD9
  for <fambfmii@mydomain.com>; Sun,  1 Mar 2015 04:20:12 +1300 (NZDT)
Authentication-Results: service.mydomain.com; dkim=pass
  reason="2048-bit key; unprotected key"
  header.d=googlemail.com header.i=@googlemail.com header.b=flcXD2tw;
  dkim-adsp=pass; dkim-atps=neutral
Received: by wghb13 with SMTP id b13so6428727wgh.2
        for <fambfmii@mydomain.com>; Sat, 28 Feb 2015 07:20:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=20120113;
        h=mime-version:from:to:subject:message-id:date:content-type;
        bh=thNUSyqg9cxzoVV3wQQPzs5jLQUlj/POqhrDqY/p1+s=;
        b=flcXD2tw+G6XLYhwGlNqRunKXmEqanLfLfxserILW3WU+m5ezqkCcQFIeYEHAoIznM
         QVIbSv2NWM9ypPc7iEVESIYUv2b2jBYz1kU46U+qZPYx7Gdw57RbZ7PgfnQpKcfoc101
         eVbgX+vb5y9oIxIs6yjr9ggnoMn2/5P2UxdlF9QOY9ATaRHmLPupfTJHrdgzBPV696rR
         033d6A6a8lFQRR9ReN4OKHHVNrwiiZpmSo0E8lAp+aU2VPrnQSK0fzFr5qdz3ZpVI7hl
         c162Q9P+5uGggaSz70xc1vDaQRg3Ch7axLL3YGNSZjqkQGBEYOvCEyLgnYcPucvqPDpx
         jiXQ==
X-Received: by 10.180.91.79 with SMTP id cc15mr9706181wib.37.1425136810420;
        Sat, 28 Feb 2015 07:20:10 -0800 (PST)
MIME-Version: 1.0
Received: by 10.180.91.79 with SMTP id cc15mr6423807wib.37; Sat, 28 Feb 2015
 07:20:10 -0800 (PST)
From: Mail Delivery Subsystem <mailer-daemon@googlemail.com>
To: fambfmii@mydomain.com
X-Failed-Recipients: pl8798@gone.bristol.ac.uk
Subject: Delivery Status Notification (Failure)
Message-ID: <f46d043be24657694405102785cc@google.com>
Date: Sat, 28 Feb 2015 15:20:10 +0000
Content-Type: text/plain; charset=UTF-8

Delivery to the following recipient failed permanently:

     pl8798@gone.bristol.ac.uk

Technical details of permanent failure: 
Google tried to deliver your message, but it was rejected by the server for the recipient domain gone.bristol.ac.uk by aspmx.l.google.com. [173.194.78.27].

The error that the other server returned was:
550-5.1.1 The email account that you tried to reach does not exist. Please try
550-5.1.1 double-checking the recipient's email address for typos or
550-5.1.1 unnecessary spaces. Learn more at
550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 q6si9283951wic.32 - gsmtp


----- Original message -----

X-Received: by 10.180.91.79 with SMTP id cc15mr9706178wib.37.1425136810390;
        Sat, 28 Feb 2015 07:20:10 -0800 (PST)
X-Gm-Message-State: ALoCoQnh7/8Nv8/oHTiqX41mEzEmq5oNlGy3zy9p01XvfZJzOXyug+NN1QL8PqIJE56gTu5omL6Iy8tNn2AMT43KwsrGdBs94LPANr7ogrNhdcQTKEM2z86gPVU+j4dvqeA9AziAbSPqtFZXBhNv4pZmS8GMWor91A==
X-Received: by 10.180.91.79 with SMTP id cc15mr9706170wib.37.1425136810311;
        Sat, 28 Feb 2015 07:20:10 -0800 (PST)
Return-Path: <fambfmii@mydomain.com>
Received: from mail-we0-f174.google.com (mail-we0-f174.google.com. [74.125.82.174])
        by mx.google.com with ESMTPS id ei1si9166190wib.92.2015.02.28.07.20.09
        for <pl8798@my.bristol.ac.uk>
        (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Sat, 28 Feb 2015 07:20:09 -0800 (PST)
Received-SPF: pass (google.com: domain of fambfmii@mydomain.com designates 74.125.82.174 as permitted sender) client-ip=74.125.82.174;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of fambfmii@mydomain.com designates 74.125.82.174 as permitted sender) smtp.mail=fambfmii@mydomain.com
Received: by wevm14 with SMTP id m14so25473931wev.13
        for <pl8798@my.bristol.ac.uk>; Sat, 28 Feb 2015 07:20:09 -0800 (PST)
X-Received: by 10.180.86.227 with SMTP id s3mr16337114wiz.58.1425126758697;
        Sat, 28 Feb 2015 04:32:38 -0800 (PST)
X-Received: by 10.180.86.227 with SMTP id s3mr16337091wiz.58.1425126758539;
        Sat, 28 Feb 2015 04:32:38 -0800 (PST)
Return-Path: <fambfmii@mydomain.com>
Received: from psmtp.com (eu1sys200amx130.postini.com. [207.126.144.199])
        by mx.google.com with SMTP id jw7si8639670wid.30.2015.02.28.04.32.24;
        Sat, 28 Feb 2015 04:32:36 -0800 (PST)
Received-SPF: softfail (google.com: domain of transitioning fambfmii@mydomain.com does not designate 104.220.1.229 as permitted sender) client-ip=104.220.1.229;
Received: from 207.126.147.10 ([104.220.1.229]) by eu1sys200amx130.postini.com ([207.126.147.10]) with SMTP;
  Sat, 28 Feb 2015 12:32:35 GMT
Message-ID: <33056530637875-BYSNNTYECPKUCTWUAKMJCCT@wikjczxin.brillian.com>
From: "Charlotte Freeman" <Charlotte.Freeman@brillian.com>
Subject: Re: Afraid of awkward situations? New ED meds won't let you down!
To: sanjida.oconnell@bristol.ac.uk
Date: Sat, 28 Feb 2015 18:27:35 +0600
Mime-Version: 1.0
Content-Type: text/html;
Content-Transfer-Encoding: 7Bit
X-pstn-mail-from: <fambfmii@mydomain.com>
X-pstn-levels: (S: 0.00000/ 4.08422 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-status: off
X-pstn-nxpr: disp=neutral, envrcpt=pl8798@bristol.ac.uk
X-pstn-nxp: bodyHash=7f565d975b7ab6918b9cc998090b1e19665421b6, headerHash=4e9622b17df37a9b31ee0f1651d42a67c3d3570d, keyName=4, rcptHash=6bfa24bd4d3660f3d9132cffc038b04e7adf948c, sourceip=104.220.1.229, version=1
X-pstn-nxp: bodyHash=7f565d975b7ab6918b9cc998090b1e19665421b6, headerHash=4e9622b17df37a9b31ee0f1651d42a67c3d3570d, keyName=4, rcptHash=6bfa24bd4d3660f3d9132cffc038b04e7adf948c, sourceip=104.220.1.229, version=1

----- End of message -----

It appears that google accepts and tries to deliver spam messages originating from my domain. It does not look to me that these email enter the system via my smtp server, as no ips in the email match it. It looks like these are simply bounces from the recipient mail system to the address that specified as sender (which does not exist on my domain and ends up in the catchall mailbox).

I'm now getting hundreds of these a day. Is it possible that this is because I somehow misconfigured SPF?

This is my spf record:

v=spf1 a mx include:_spf.google.com ~all

Most of my setup (except SPF and DKIP that I just added recently) is described here: Postfix/Dovecot permissions on new files in a mailbox)

  • You use gmail as relay to deliver emails? Looks like you have an open relay or a spammer on your system. What can you find in the mail log for outgoing mail which gets delivered to gmail? Please describe your setup and show it's configuration. – sebix Feb 28 '15 at 20:08
  • Actually I don't use gmail as relay. I put this spf line only because people reported that it helped them in a similar situation, and it did also help me. I have deleted it now but it will take some time to propagate to see what effect it had (like if it stopped this spam and if it stopped gmail from receiving emails from my domain again) – Andrew Savinykh Feb 28 '15 at 20:11
  • @sebix I've added to the question information on my setup. It does not look to me like it's an open relay as it has never been a problem. Also I do not believe that this spam enter internet at my system, as I can't find the original emails (not the bounces) in the logs – Andrew Savinykh Feb 28 '15 at 20:14
4

I believe what you are encountering is a Backscatter email, check wikipedia for detailed description. In brief, backscatter happens when someone sends out spam using forged addresses, in this case yours, and the bounce messages send back to your address. Many mail servers resolve this by tagging every email they send out, using a technique called Bounce Address Tag Validation(BATV) and when they get bounce back emails the mail server can tell whether it was a bounce back of an email it previously sent or not. If it is not, it rejects it or labels it as spam depending how you configure it.

Looking at the header of the original message, the return-path is set to your address, which means if the email by the spammer fails to get delivered, the bounce back will be sent to your address.

Return-Path: <fambfmii@mydomain.com>

The originating IP appears to be 104.220.1.229, doing a quick search on DNSBL shows this IP has been listed as a source of spam by many.

Received-SPF: softfail (google.com: domain of transitioning fambfmii@mydomain.com does not designate 104.220.1.229 as permitted sender) client-ip=104.220.1.229;

Solution - you might need to setup BATV to prevent such scatter back emails in the future.

In addition to that please review you SPF entry, you said you don't use gmail as relay, then why put Gmail's SPF record? SPF record is meant to add the list of sender hosts that are the legitimate sources of email for your domain. If you don't use gmail for relaying, then remove it from your SPF record. Only add the IPs of the sending hosts in your SPF record.

  • Thank you vey much for this, I find your answer useful. As far as SPF goes, I did this because i was receiving an smtp warning or error from gmail smtp sever when any emails were sent to gmail from my domain. Adding spf and dkip stopped that. I removed spf for now and I'll monitor the situation to see how it affects both things - this spam and acceptance of my domain emails by gmail. – Andrew Savinykh Feb 28 '15 at 20:56
  • Also note that fambfmii address and many others that the emails are bounced to do not exist. I'm only seing these because I monitor the catchall mailbox that accepts emails for all inexistent addresses in my domain. Note also that email body does not contain anything so I'm not sure if the purpose of this really is to get someone to read the email bounce.... – Andrew Savinykh Feb 28 '15 at 21:04
  • @zespri The purpose is not to get the bounces read, they are just a side-effect of massive spamming, i.e. many recipients do not exist and so the messages bounce back to the (made up) sender. By using BATV, you can tag the messages you send out for real, and only deliver the bounces associated to them (and not those coming from anybody using an address in your domain to send spam but not going through your server). – Ale Feb 28 '15 at 22:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.