email sent from virtual domains on server being tagged as spam
Howard Fleming
hfleming at moosebird.net
Thu Aug 6 20:18:04 UTC 2015
The ip address (67.233.71.80) is the address of the email client that is
sending email to my server.
For the moment, I have disabled the rbl list and that has (poorly) fixed
the problem for now... .
What I hope I can do (still researching this) is have rbl checking
turned off for email received via port 587, and only allow my
authenticated users to to use this port.
Thanks,
Howard
On 08/06/2015 01:21 PM, Kevin Miller wrote:
>
> Received: from [192.168.15.109] (va-67-233-71-80.dhcp.embarqhsd.net
> [67.233.71.80])
>
> by comm.moosebird.net (Postfix) with ESMTPSA id 1981B2A01E3
>
> for <hfleming at moosebird.net>; Tue, 4 Aug 2015 11:38:54 -0400
> (EDT)
>
> See
> http://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a%0967.233.71.80&run=toolpage
>
> IP 67.233.71.80 is blacklisted. Since you’re including spamhaus and/or
> barracuda in your blacklists you block those mails. The cheesy
> workaround is to whitelist them, or quit using the RBLs. Not much of
> an option. The better solution is to find out why you’re blacklisted
> (see the spamhaus page) and take the steps to get removed.
>
> Looking up your server IP, it appears that it’s a DHCP address which
> would probably normally be assigned to a home user. Your email server
> should have a static IP.
>
> $ host 67.233.71.80
>
> 80.71.233.67.in-addr.arpa domain name pointer
> va-67-233-71-80.dhcp.embarqhsd.net.
>
> Running a RBL lookup at dns-stuff.com I see this:
>
> SBL-ZEN IP detected as NON-COMPLIANT (End-user Non-MTA IP
> addresses set by ISP outbound mail policy)
>
> SPAMHAUS PBL IP detected as SPAM
>
> Hope this helps some.
>
> ...Kevin
> --
> Kevin Miller
> Network/email Administrator, CBJ MIS Dept.
> 155 South Seward Street
> Juneau, Alaska 99801
> Phone: (907) 586-0242, Fax: (907) 586-4500
> Registered Linux User No: 307357
>
> *From:*MailScanner [mailto:mailscanner-bounces at lists.mailscanner.info]
> *On Behalf Of *Howard Fleming
> *Sent:* Thursday, August 06, 2015 8:42 AM
> *To:* MailScanner Discussion
> *Subject:* Re: email sent from virtual domains on server being tagged
> as spam
>
> Hi Jerry,
>
> This is probably under the heading of a newbie question, but how do I
> go about fixing this?
>
> It appears spamhaus is picking up the ip address of the email client
> sending the the email, since it is being delivered locally on the
> server. I assume this is a postfix configuration issue?
>
> Thanks,
> Howard
>
> On 08/06/2015 12:18 PM, Jerry Benton wrote:
>
> It is triggering on your RBLs.
>
> X-Moosebird-MailScanner-SpamCheck: spam, spamhaus-ZEN
>
>
> -
>
> Jerry Benton
>
> www.mailborder.com <http://www.mailborder.com>
>
> On Aug 6, 2015, at 12:16 PM, Howard Fleming
> <hfleming at moosebird.net <mailto:hfleming at moosebird.net>> wrote:
>
> Header info:
>
> http://pastebin.com/FRpcJirk
>
> Virtual domains are handled by postfix (and if this is not what you are looking for, please let me know):
>
>
>
> main.cf:
>
> virtual_alias_domains = hash:/etc/postfix/virtual_alias_domains
>
> virtual_alias_maps = hash:/etc/postfix/virtual_alias_maps
>
>
>
> MTA is postfix.
>
>
>
> Thanks,
>
> Howard
>
>
>
>
>
>
> On 08/06/2015 11:41 AM, Jeremy McSpadden wrote:
>
> Pastebin the header of one of the emails. What are you
> using for virtual domains ? What mta ?
>
> --
> Jeremy McSpadden | Flux Labs
> Local - 850-250-5590x501 <tel:850-250-5590;501> | Mobile -
> 850-890-2543 <tel:850-890-2543>
> Fax - 850-254-2955 <tel:850-254-2955> | Toll Free -
> 877-699-FLUX <tel:877-699-FLUX>
> Web - http://www.fluxlabs.net <http://www.fluxlabs.net/>
>
>
> On Aug 6, 2015, at 10:36 AM, Howard Fleming
> <hfleming at moosebird.net <mailto:hfleming at moosebird.net>>
> wrote:
>
> Good morning,
>
> I am in the process of rebuilding my mail server and
> running into a problem with any email sent from the 2
> virtual domains on the system is being flagged as spam
> by MailScanner (the other 2 domains that are not
> virtual is working as it should). Other than the
> virtual domain outgoing email being flagged as spam,
> everything appears to be working as it should.
>
> Any suggestions on where to start looking and what
> additional information I need to send here for
> troubleshooting?
>
> System info:
>
> CentOS 6.6
> Postfix version 2.6.6, Release 6.el6_5
>
> MailScanner -v
> Running on
> Linux comm.moosebird.net <http://comm.moosebird.net/>
> 2.6.32-504.30.3.el6.x86_64 #1 SMP Wed Jul 15 10:13:09
> UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
> This is CentOS release 6.6 (Final)
> This is Perl version 5.010001 (5.10.1)
>
> This is MailScanner version 4.85.2
> Module versions are:
> 1.00 AnyDBM_File
> 1.30 Archive::Zip
> 0.23 bignum
> 1.11 Carp
> 2.021 Compress::Zlib
> 1.119 Convert::BinHex
> 0.17 Convert::TNEF
> 2.124 Data::Dumper
> 2.27 Date::Parse
> 1.03 DirHandle
> 1.06 Fcntl
> 2.77 File::Basename
> 2.14 File::Copy
> 2.02 FileHandle
> 2.08 File::Path
> 0.22 File::Temp
> 0.92 Filesys::Df
> 3.64 HTML::Entities
> 3.64 HTML::Parser
> 3.57 HTML::TokeParser
> 1.25 IO
> 1.14 IO::File
> 1.13 IO::Pipe
> 2.04 Mail::Header
> 1.9993 Math::BigInt
> 0.22 Math::BigRat
> 3.08 MIME::Base64
> 5.427 MIME::Decoder
> 5.427 MIME::Decoder::UU
> 5.427 MIME::Head
> 5.427 MIME::Parser
> 3.08 MIME::QuotedPrint
> 5.427 MIME::Tools
> 0.14 Net::CIDR
> 1.25 Net::IP
> 0.19 OLE::Storage_Lite
> 1.04 Pod::Escapes
> 3.13 Pod::Simple
> 1.17 POSIX
> 1.21 Scalar::Util
> 1.82 Socket
> 2.20 Storable
> 1.4 Sys::Hostname::Long
> 0.27 Sys::Syslog
> 1.40 Test::Pod
> 0.92 Test::Simple
> 1.9721 Time::HiRes
> 1.02 Time::localtime
>
> Optional module versions are:
> 1.58 Archive::Tar
> 0.23 bignum
> missing Business::ISBN
> missing Business::ISBN::Data
> 1.15 Data::Dump
> 1.82 DB_File
> 1.27 DBD::SQLite
> 1.609 DBI
> 1.16 Digest
> 1.01 Digest::HMAC
> 2.39 Digest::MD5
> 2.12 Digest::SHA1
> 1.01 Encode::Detect
> 0.17015 Error
> 0.27 ExtUtils::CBuilder
> 2.2203 ExtUtils::ParseXS
> 2.38 Getopt::Long
> 0.46 Inline
> 1.08 IO::String
> 1.09 IO::Zlib
> 2.28 IP::Country
> 0.29 Mail::ClamAV
> 3.003001 Mail::SpamAssassin
> v2.008 Mail::SPF
> 1.999001 Mail::SPF::Query
> 0.35 Module::Build
> 0.21 Net::CIDR::Lite
> 0.65 Net::DNS
> v0.003 Net::DNS::Resolver::Programmable
> 0.65 Net::LDAP
> 4.027 NetAddr::IP
> 1.965001 Parse::RecDescent
> missing SAVI
> 3.17 Test::Harness
> 1.22 Test::Manifest
> 2.0.0 Text::Balanced
> 1.40 URI
> 0.77 version
> missing YAML
>
>
> MailScanner --lint
> Trying to setlogsock(unix)
>
> Reading configuration file
> /etc/MailScanner/MailScanner.conf
> Reading configuration file /etc/MailScanner/conf.d/README
> Read 462 hostnames from the phishing whitelist
> Read 12121 hostnames from the phishing blacklists
>
> Checking version numbers...
> Version number in MailScanner.conf (4.85.2) is correct.
>
> Your envelope_sender_header in
> spam.assassin.prefs.conf is correct.
> MailScanner setting GID to (89)
> MailScanner setting UID to (89)
>
> Checking for SpamAssassin errors (if you use it)...
> Using SpamAssassin results cache
> Connected to SpamAssassin cache database
> SpamAssassin reported no errors.
> Connected to Processing Attempts Database
> Created Processing Attempts Database successfully
> There are 0 messages in the Processing Attempts Database
> Using locktype = posix
> MailScanner.conf says "Virus Scanners = clamd"
> Found these virus scanners installed: clamavmodule, clamd
> ===========================================================================
> Filename Checks: Windows/DOS Executable (1 eicar.com
> <http://eicar.com/>)
> Other Checks: Found 1 problems
> Virus and Content Scanning: Starting
> Clamd::INFECTED:: Eicar-Test-Signature ::
> ./1/eicar.com <http://eicar.com/>
> Virus Scanning: Clamd found 2 infections
> Infected message 1 came from 10.1.1.1
> Virus Scanning: Found 2 viruses
> ===========================================================================
> Virus Scanner test reports:
> Clamd said "eicar.com <http://eicar.com/> was
> infected: Eicar-Test-Signature"
>
> If any of your virus scanners (clamavmodule,clamd)
> are not listed there, you should check that they are
> installed correctly
> and that MailScanner is finding them correctly via its
> virus.scanners.conf.
>
> Thanks for any help,
> Howard
>
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> <mailto:mailscanner at lists.mailscanner.info>
> http://lists.mailscanner.info/listinfo/mailscanner
>
>
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> <mailto:mailscanner at lists.mailscanner.info>
> http://lists.mailscanner.info/listinfo/mailscanner
>
>
>
>
>
>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150806/c4c110a1/attachment-0001.html>
More information about the MailScanner
mailing list