0

I have built a Postfix server on CentOS 7 this week. It is perfectly blocking spam, but I got some problems with some email address that bypass SpamAssassin :

Jan  9 04:49:14 gauss postfix/qmgr[29958]: 59CF75C7B69: from=<shangyou1@edmdmdm.com>, size=13995, nrcpt=3 (queue active)
Jan  9 04:49:14 gauss postfix/qmgr[29958]: 2ED385C7B6A: from=<shangyou1@edmdmdm.com>, size=13995, nrcpt=2 (queue active)
Jan  9 04:49:14 gauss postfix/qmgr[29958]: 300835C7B6B: from=<shangyou1@edmdmdm.com>, size=13995, nrcpt=1 (queue active)

Jan  9 04:49:15 gauss postfix/smtp[5982]: 300835C7B6B: host gmail-smtp-in.l.google.com[74.125.22.26] said: 421-4.7.0 [144.217.165.242      15] Our system has detected that this message is 421-4.7.0 suspicious due to the nature of the content and/or the links within. 421-4.7.0 To best protect our users from spam, the message has been blocked. 421-4.7.0 Please visit 421 4.7.0  https://support.google.com/mail/answer/188131 for more information. x67si2021254qka.111 - gsmtp (in reply to end of DATA command)
Jan  9 04:49:15 gauss postfix/smtp[5981]: 2ED385C7B6A: host gmail-smtp-in.l.google.com[74.125.22.26] said: 421-4.7.0 [144.217.165.242      15] Our system has detected that this message is 421-4.7.0 suspicious due to the nature of the content and/or the links within. 421-4.7.0 To best protect our users from spam, the message has been blocked. 421-4.7.0 Please visit 421 4.7.0  https://support.google.com/mail/answer/188131 for more information. h27si55978305qth.307 - gsmtp (in reply to end of DATA command)
Jan  9 04:49:15 gauss postfix/smtp[5980]: 59CF75C7B69: host gmail-smtp-in.l.google.com[74.125.22.26] said: 421-4.7.0 [144.217.165.242      15] Our system has detected that this message is 421-4.7.0 suspicious due to the nature of the content and/or the links within. 421-4.7.0 To best protect our users from spam, the message has been blocked. 421-4.7.0 Please visit 421 4.7.0  https://support.google.com/mail/answer/188131 for more information. v7si2253295qta.64 - gsmtp (in reply to end of DATA command)
Jan  9 04:49:18 gauss postfix/smtp[5981]: 2ED385C7B6A: to=<beard.kings.info@gmail.com>, orig_to=<info@barbaware.com>, relay=alt1.gmail-smtp-in.l.google.com[64.233.190.26]:25, delay=63302, delays=63299/0.1/2.6/0.85, dsn=4.7.0, status=deferred (host alt1.gmail-smtp-in.l.google.com[64.233.190.26] said: 421-4.7.0 [144.217.165.242      15] Our system has detected that this message is 421-4.7.0 suspicious due to the nature of the content and/or the links within. 421-4.7.0 To best protect our users from spam, the message has been blocked. 421-4.7.0 Please visit 421 4.7.0  https://support.google.com/mail/answer/188131 for more information. y42si393157qtc.47 - gsmtp (in reply to end of DATA command))
Jan  9 04:49:18 gauss postfix/smtp[5980]: 59CF75C7B69: to=<beard.kings.info@gmail.com>, orig_to=<info@beard-kings.com>, relay=alt1.gmail-smtp-in.l.google.com[64.233.186.26]:25, delay=63306, delays=63302/0.63/2.6/0.86, dsn=4.7.0, status=deferred (host alt1.gmail-smtp-in.l.google.com[64.233.186.26] said: 421-4.7.0 [144.217.165.242      15] Our system has detected that this message is 421-4.7.0 suspicious due to the nature of the content and/or the links within. 421-4.7.0 To best protect our users from spam, the message has been blocked. 421-4.7.0 Please visit 421 4.7.0  https://support.google.com/mail/answer/188131 for more information. o67si46102547qka.120 - gsmtp (in reply to end of DATA command))
Jan  9 04:49:18 gauss postfix/smtp[5982]: 300835C7B6B: to=<beard.kings.info@gmail.com>, relay=alt1.gmail-smtp-in.l.google.com[64.233.190.26]:25, delay=63301, delays=63298/0.1/2.6/0.85, dsn=4.7.0, status=deferred (host alt1.gmail-smtp-in.l.google.com[64.233.190.26] said: 421-4.7.0 [144.217.165.242      15] Our system has detected that this message is 421-4.7.0 suspicious due to the nature of the content and/or the links within. 421-4.7.0 To best protect our users from spam, the message has been blocked. 421-4.7.0 Please visit 421 4.7.0  https://support.google.com/mail/answer/188131 for more information. 65si46223303qth.15 - gsmtp (in reply to end of DATA command))

But as usual, SpamAssassin acts like this on incoming emails :

Jan  9 04:58:55 gauss postfix/pipe[6214]: AB4D86A96E6: to=<imdc.technologies@gmail.com>, orig_to=<postmaster@dasio.org>, relay=spamassassin, delay=4.4, delays=0.38/0.04/0/3.9, dsn=2.0.0, status=sent (delivered via spamassassin service)
Jan  9 04:58:55 gauss postfix/pickup[3283]: 0B3766A96EE: uid=5001 from=<noreply-dmarc-support@google.com>
Jan  9 04:58:55 gauss postfix/cleanup[6210]: 0B3766A96EE: message-id=<14320855272110755711@google.com>
Jan  9 04:58:55 gauss opendkim[1038]: 0B3766A96EE: no signing table match for 'noreply-dmarc-support@google.com'
Jan  9 04:58:55 gauss opendkim[1038]: 0B3766A96EE: DKIM verification successful
Jan  9 04:58:55 gauss postfix/qmgr[29958]: 0B3766A96EE: from=<noreply-dmarc-support@google.com>, size=4043, nrcpt=1 (queue active)
Jan  9 04:58:55 gauss spamd[439]: spamd: setuid to spamd succeeded
Jan  9 04:58:56 gauss postfix/smtp[6220]: 0B3766A96EE: to=<imdc.technologies@gmail.com>, relay=gmail-smtp-in.l.google.com[74.125.22.27]:25, delay=1.4, delays=0.51/0.03/0.54/0.27, dsn=2.0.0, status=sent (250 2.0.0 OK 1483955936 p56si5198118qtc.217 - gsmtp)
Jan  9 04:58:56 gauss postfix/qmgr[29958]: 0B3766A96EE: removed
Jan  9 04:58:58 gauss spamd[439]: spamd: processing message <14320855272110755711@google.com> for spamd:5001
Jan  9 04:59:01 gauss spamd[439]: spamd: clean message (1.3/5.0) for spamd:5001 in 8.3 seconds, 3542 bytes.
Jan  9 04:59:01 gauss spamd[439]: spamd: result: . 1 - DATE_IN_PAST_06_12,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,RP_MATCHES_RCVD,SPF_PASS,TVD_SPACE_RATIO,URIBL_BLOCKED scantime=8.3,size=3542,user=spamd,uid=5001,required_score=5.0,rhost=localhost,raddr=::1,rport=57088,mid=<14320855272110755711@google.com>,autolearn=unavailable autolearn_force=no

Am I missing something in the config ? How can I make SpamAssassin analyse the emails incoming from "shangyou1@edmdmdm.com" for example ?

Thank you very much and have a great day !

  • Why is your system relaying mail to Google? – Michael Hampton Jan 10 '17 at 5:30
  • Because it is forwarding the hosted email address to a gmail account. – dctremblay Jan 11 '17 at 20:12
  • It's time to look at your postfix configuration. – Michael Hampton Jan 11 '17 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.