Relay Problem !

[emborsatti]

hi,

i instaled zimbra collaboration, it's work fine, but i have one problem.
My relay is blocked, my domains defined, but at certains time a email from a different domain start to send to others, but is not a email from my cleared domains.

I make various test of relay, and always is blocked. I look my logs and the false email is based from my server, 127.0.0.1 !

What can i do to block this?

When i see my queue have 15000 emails stopped and my cpu is 100% and normally my queue have 60 mails and cpu 15%.

Thanks for everyone.

[uxbod]

Welcome to the forums

Please post the headers from one of the emails. It could just be backscatter and somebody spoofing with one of your domains.

[raj]

or someone (i.e: spammer) has gussed the password of your user and is using SMTP AUTH to relay spam thru your server.
in your /var/log/maillog
if you search for sasl_username= and you may get lines line sasl_username=someuser ..see if some user is repating a lot..if yes then that users password is compromised...change it asap

code:
tail -n 100000 /var/log/maillog | grep "sasl_username=" > smtpauthlogins.txt


just guessing..unless you post some recent logs based on above


Raj

[emborsatti]

Ok, i go to try....thanks raj