envelope-from header missing

Mon Dec 7 09:59:57 UTC 2020

s/empty/missing/

On 12/7/20 4:57 AM, Shawn Iverson via MailScanner wrote:
>
> Gmail is complaining because the From: field is empty, not because of 
> the null envelope from.  What is removing the From: address from the 
> notification?  The envelope from and the from header are supposed to 
> be independent.
>
> "U=mailnull"
>
>
> On 12/7/20 3:50 AM, Emanuel Vidmar - Avant.Si wrote:
>> I don't actually send it via Mail Control. It is sent automatically 
>> in reply to emails containing virus or bad attachments.
>> You say that null FROM is perfectly legitimate, but Gmail obviously 
>> disagrees :)
>>
>> This is an example of such message:
>>
>> [root@~]# exigrep "1klynS-000AX0-TA" /var/log/exim_mainlog
>> 2020-12-06 19:30:11 cwd=/var/spool/exim/input 5 args: /usr/sbin/exim 
>> -C /etc/exim_outgoing.conf -Mc 1klynS-000AX0-TA
>>
>> 2020-12-07 07:00:05 cwd=/usr/local/cpanel/whostmgr/docroot 6 args: 
>> /usr/sbin/exim -C /etc/exim_outgoing.conf -v -Mrm 1klynS-000AX0-TA
>>
>> 2020-12-06 19:30:10 1klynS-000AX0-TA <= <> U=mailnull P=MailScanner 
>> S=1131 T="{Opozorilo} Zlonamerno e-postno sporocilo (virus)" for 
>> *****@gmail.com <http://gmail.com>
>> 2020-12-06 19:30:11 1klynS-000AX0-TA check_mail_permissions could not 
>> determine the sender domain [routed_domain=gmail.com 
>> <http://gmail.com> message_exim_id=1klynS-000AX0-TA 
>> sender_host_address= recipients_count=1]
>> 2020-12-06 19:30:11 1klynS-000AX0-TA ** izafasun at gmail.com 
>> <mailto:izafasun at gmail.com> R=dkim_lookuphost T=dkim_remote_smtp 
>> H=gmail-smtp-in.l.google.com <http://gmail-smtp-in.l.google.com> 
>> [74.125.206.26] X=TLS1.2:ECDHE-ECDSA-AES128-GCM-SHA256:128 CV=yes: 
>> SMTP error from remote mail server after end of data: 550-5.7.1 
>> [152.89.234.38      11] Our system has detected that this message 
>> is\n550-5.7.1 not RFC 5322 compliant:\n550-5.7.1 'From' header is 
>> missing.\n550-5.7.1 To reduce the amount of spam sent to Gmail, this 
>> message has been\n550-5.7.1 blocked. Please visit\n550-5.7.1 
>> https://support.google.com/mail/?p=RfcMessageNonCompliant\n550 5.7.1 
>> and review RFC 5322 specifications for more information. 
>> g4si8507930wma.67 - gsmtp
>> 2020-12-06 19:30:11 1klynS-000AX0-TA Frozen (delivery error message)
>> 2020-12-06 19:50:46 1klynS-000AX0-TA Message is frozen
>> 2020-12-06 20:48:19 1klynS-000AX0-TA Message is frozen
>> 2020-12-06 21:48:34 1klynS-000AX0-TA Message is frozen
>> 2020-12-06 22:48:31 1klynS-000AX0-TA Message is frozen
>> 2020-12-06 23:48:40 1klynS-000AX0-TA Message is frozen
>>
>>
>> --------------------------------
>>
>> I was hoping there is some config that I could change to fix that, 
>> since this is a pretty common setup (cpanel + Configserver Mailscanner).
>>
>> Thanks.
>>
>>
>> Regards,
>>
>> Emanuel
>> --------------------
>> Avant.si d.o.o.
>> www.avant.si <http://www.avant.si>
>>
>> ᐧ
>>
>> V V pon., 7. dec. 2020 ob 03:56 je oseba Mark Sapiro 
>> <mark at msapiro.net <mailto:mark at msapiro.net>> napisala:
>>
>>     On 12/6/20 12:43 PM, Emanuel Vidmar - Avant.Si wrote:
>>     > Mark, thank you for your reply.
>>     > I am not sure what could have caused that, this is a fairly simple
>>     > cPanel (Exim) + ConfigServer Mailscanner setup. No special
>>     > configuration. I have contacted ConfigServer's support first,
>>     this was
>>     > their answer:
>>     >
>>     > "Outbound notification from MailScanner does not have the
>>     envelope-from
>>     > field and therefore the From in MailControl is not populated.
>>     I'm afraid
>>     > there's nothing we can do from our end to resolve this issue,
>>     you'd need
>>     > to check the MailScanner newsgroup to find out if there is
>>     anything that
>>     > can be done."
>>
>>
>>     I guess this is an issue with MailControl. If MailControl is
>>     rewriting
>>     the From: with the envelope sender, they just can't handle this mail.
>>     Judging from their web site, I think it's likely they are doing
>>     just that.
>>
>>     Note that a null MAIL FROM: address is perfectly legitimate any
>>     time you
>>     don't want an undeliverable DSN returned. For one example, almost all
>>     MTAs send DSNs with null MAIL FROM: to avoid bounce loops.
>>     MailScanner
>>     does this with user notifications for similar reasons.
>>
>>     Do you have to send mail via MailControl?
>>
>>     Note that the places where MailScanner sends with a null envelope
>>     are at
>>
>>     https://github.com/MailScanner/v5/blob/master/common/usr/share/MailScanner/perl/MailScanner/MCPMessage.pm#L518
>>
>>     https://github.com/MailScanner/v5/blob/master/common/usr/share/MailScanner/perl/MailScanner/MCPMessage.pm#L566
>>
>>     Although MCP probably isn't involved in your case, and
>>
>>     https://github.com/MailScanner/v5/blob/master/common/usr/share/MailScanner/perl/MailScanner/Message.pm#L1558
>>
>>     https://github.com/MailScanner/v5/blob/master/common/usr/share/MailScanner/perl/MailScanner/Message.pm#L1606
>>
>>     https://github.com/MailScanner/v5/blob/master/common/usr/share/MailScanner/perl/MailScanner/Message.pm#L1755
>>
>>     https://github.com/MailScanner/v5/blob/master/common/usr/share/MailScanner/perl/MailScanner/Message.pm#L6618
>>
>>     You could patch those lines changing '<>' to $localpostmaster. I.e.
>>     change something like
>>
>>     ... SendMessageString($this, $emailmsg, '<>')
>>
>>     to
>>
>>     ... SendMessageString($this, $emailmsg, $localpostmaster)
>>
>>     -- 
>>     Mark Sapiro <mark at msapiro.net <mailto:mark at msapiro.net>>      
>>     The highway is for gamblers,
>>     San Francisco Bay Area, California    better use your sense - B.
>>     Dylan
>>
>>
>>     -- 
>>     MailScanner mailing list
>>     mailscanner at lists.mailscanner.info
>>     <mailto:mailscanner at lists.mailscanner.info>
>>     http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>>
> -- 
>
> Shawn Iverson
> shawniverson at summitgrid.com
>
>
-- 

Shawn Iverson
shawniverson at summitgrid.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20201207/4cc4a363/attachment.html>