[SOLVED] My email server are spamming

[MrDin]

Hi all,

From my daily generated mail report, i always notice that most of 'most active sender' aren't from user account. Below senders are definitely not from my email user. It's like my server are sending spam.

Most active senders
14 jquijada@tecnoconsult.com
9 jrandall@theemploymentguide.com
8 jrapoport@exponent.com
8 jqzvuesw@investors.com
8 jradwich@isurusmrc.com
8 jr@griffinbrothers.com
8 jramos@ranido.com
8 jr@jrtr.org
8 jquagliano@quagseeg.com
7 jr@proactivenet.com
5 enewsletter@eNewsletter.com.my
5 jraines@pfeiffer.edu
5 jr.jvalentine@tyrekamins.com
5 jquire@dcr.net
5 jramirez@kcmsd.net
4 webmaster@edirectadvertising.com
4 jradwanska@nfz-katowice.pl
2 root@mail.scriptlance.com
2 DEMSBOUNCE@HERBATEK.COM
2 jraine68@avantages.net
2 hlebroking@hlgs.hongleong.com.my
2 susanlim88@gmail.com
2 dhatz@phaistosnetworks.gr
2 kamaruz@aeroscan.com.my
1 iejwkfswi@bps8.ebay.sun.com
1 lam@qnsr.com
1 kucinskw@curryyoung.com
1 jrabb@sympatico.ca
1 phineas@465.com
1 DoramollieSelf@britneyspears.ac
1 sentto-17701015-4261-1194690048-iman=two-p.com@returns.groups.yahoo.com
1 codruta24ro@onebb.net
1 DoreeninkHutchison@switchboard.com
1 lowautroldun@autrol.com
1 gair@surecom.com
1 Sheree_cuff@accordions.com
1 tein@icqmail.com
1 broderick@msn.com
1 Darlene-Gyorky@asimijewelry.com
1 doan9@uk.psi.com
1 prof.solludo4q@hotmail.com
1 csupport@dotster.com
1 a1a98687@spicergroup.com
1 Kilcorse@gaol.org.uk
1 maceo@datentechnik.com
1 SheliamonasticMcneal@porscheclub.com
1 pettigrew@texolite.com

I'm not sure what this mean. Please help

[phoenix]

Hi all,

From my daily generated mail report, i always notice that most of 'most active sender' aren't from user account. Below senders are definitely not from my email user. It's like my server are sending spam.

No, they're not sending spam from your server. Zimbra is not an open relay by default. They are addresses that are sending to you not from your server.

[MrDin]

Bro, thanks for your reply. It a great help.

[preem]

I have had a lot of unknown senders too, and it bothered me as much as it bothers you.

Take a look at this thread it helped me a lot, i reduced spam for, i dunno, 90%.

[mmorse]

Though going beyond your original question...if you need to cut down spam there's also:

host checks:
reject_invalid_hostname
reject_non_fqdn_hostname
reject_non_fqdn_sender

dns checks:
reject_unknown_client
reject_unknown_hostname
reject_unknown_sender_domain
-careful with reject_unknown_client & reject_unknown_hostname as they can block more than you think sometimes...

Set them in the admin console > global settings > mta tab
or via CLI:

zmprov mcf +zimbraMtaRestriction reject_invalid_hostname

You might also change the entry in zmmta.cf for smtpd_reject_unlisted_recipients to 'yes', save the file and restart postfix. (postfix reload)

Besides sbl.spamhaus.org or zen.spamhaus.org some other rbl's include:
dnsbl.njabl.org
cbl.abuseat.org
bl.spamcop.net
dnsbl.sorbs.net
you can enable them by:

zmprov mcf +zimbraMtaRestriction "reject_rbl_client bl.spamcop.net"

That's just some quick basics, there's dozens of other threads on reducing spam if you search a bit, and the good stuff goes into a wiki article: Improving Anti-spam system - Zimbra :: Wiki

[uscell]

thanks, same i was looking for ...

Yukari !!!