Spam From my zimbra server

[kasteddaio]

Hi,

I have problems with spam.
Our server Zimbra makes spamming other servers including yahoo.com.tw.
The relay is disabled, but we've noticed that you can connect with clients through all'smtp authenticate a valid user even POP access has been disabled.

You have no idea how to solve?

Release 5.0.18_GA_3011.DEBIAN4.0 DEBIAN4.0 FOSS edition

[uxbod]

Welcome to the forums

Sorry not really following what you are saying ? You mention relay is disabled; do you mean that you have checked to ensure you are not a open-relay ? If you are using SMTP authentication then it must be someone who knows the credentials.

Would you be able to expand on the issue you are seeing please ?

[kasteddaio]

the problem is that my postmaster account send many mail to somo domain such as yahoo.com.tw .

Anyidea to solve this problem?

[uxbod]

Would you post a example please including the headers ? Also check that your server is not a open relay :-

Mail relay testing
SpamHelp.org SMTP Open Relay Test
Email Server Test - Online SMTP diagnostics tool - MxToolbox

[kasteddaio]

I have verify the open relay at Mail relay testing , the result is

Relay test result
All tests performed, no relays accepted.

an exemple email is


CO 258 239 1 0 258T^P12562022
91 79621A^Vcreate_time=1256202291A^Xlog_message_origi n=localA^Otrace_flags=256S^Wpostmaster@
mail.vol2.itO^Udk520.tw@yahoo.com.twR^Udk520.tw@ya hoo.com.twM^@N#Received: by mydomain (
Postfix)N8 id 136C6C780647; Thu, 22 Oct 2009 11:04:51 +0200 (CEST)N,Date: Thu, 22 Oct 2009
11:04:51 +0200 (CEST)N6Message-Id: <20091022090451.136C6C780647@mail.vol2.it>N^]From: postma
ster@mail.mydomain N^\To: undisclosed-recipients:;X^@E^@


tnk for you time

[uxbod]

Cannot make that out ... please just copy and paste from /var/log/zimbra.log ... have you enabled NDR to be sent ? are you getting emails coming in from Yahoo to non-existent accounts on your server ?

[phoenix]

Originally Posted by kasteddaio

I have verify the open relay at Mail relay testing , the result is

Relay test result
All tests performed, no relays accepted.

If you're not an open relay then your problem lies elsewhere. You might, for instance, have infected machines on your LAN - are any of the Windows machines?