0

we are using postfix/dovecot/amavis/spamassassin configuration with custom SA rules, etc.

But some weird mails are delivered to us, even without spam test headers and dkim tests

Example header:

Return-Path: <udqosvf@fenixinc.biz.ua>
Delivered-To: user@ourdomain.cz
Received: from localhost (localhost [127.0.0.1])
    by mx.ourserver.cz (Postfix) with ESMTP id 8A6854207E
    for <user@ourdomain.cz>; Thu, 14 Sep 2017 08:00:54 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at mx.ourserver.cz
Received: from mx.ourserver.cz ([127.0.0.1])
    by localhost (mx.ourserver.cz [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id mAd28zkivdoO for <user@ourdomain.cz>;
    Thu, 14 Sep 2017 08:00:51 +0200 (CEST)
Received-SPF: pass (fenixinc.biz.ua: 62.141.46.12 is authorized to use 'udqosvf@fenixinc.biz.ua' in 'mfrom' identity (mechanism 'a/24' matched)) receiver=mx.ourserver.cz; identity=mailfrom; envelope-from="udqosvf@fenixinc.biz.ua"; helo=mail.fenixinc.biz.ua; client-ip=62.141.46.12
Received: from mail.fenixinc.biz.ua (mail.fenixinc.biz.ua [62.141.46.12])
    by mx.ourserver.cz (Postfix) with ESMTP id A236542011
    for <user@mydomain.cz>; Thu, 14 Sep 2017 08:00:51 +0200 (CEST)
Received: from fenixinc.biz.ua (mail.fenixinc.biz.ua [62.141.46.12])
    by mail.fenixinc.biz.ua (Postfix) with ESMTPA id 833118C313;
    Thu, 14 Sep 2017 06:07:31 +0300 (EEST)
Message-ID: <udqosvf34621287.80857417@mail.fenixinc.biz.ua>
Reply-To: "ED Packs" <udqosvf@fenixinc.biz.ua>
From: "ED Packs" <udqosvf@fenixinc.biz.ua>
To: <**x.v@azckjykrclbk.cz**>
Subject: ED Packs for Potency
Date: Thu, 14 Sep 2017 06:07:35 +0300
MIME-Version: 1.0
Content-Type: multipart/related;
    type="multipart/alternative";
    boundary="----=_NextPart_000_0006_01D32D1F.7177D070"

Precedence: bulk
List-Id: b30356035v06500326
X-Complaints-To: abuse@fenixinc.biz.ua
List-Unsubscribe: <http://fenixinc.biz.ua/ru/unsubscribe/do?hash=7468576857015011>

As you can see, TO: is x.v@azckjykrclbk.cz which is definitely not our domain or even user, but is strangely delivered to random user's mailbox. No domain basket is in use.

What could be the problem?

0

When an email is sent, the SMTP Server is creating a SMTP envelope which contains the recipient(s) (RCPT TO:) header and the sender of the message (MAIL FROM:) header. The recipient(s) header is used to determine actual recipient(s) of the email. To: header is used by email readers (part of email DATA) to show you who the recipient(s) are. Envelope and DATA header addresses will usually match but they don't have to. Spammers often forge these headers to try to avoid spam filters.

It would be interesting to see your postfix or SpamAssassin/Amavis logs. Try to look at postfix address verification and postfix smtp relay and access control pages.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.