open relay??

[Bill Brock]

Server settings. "MTA", "IMAP", and "POP"

[JMoreno]

Hi guys,

After suffering 20-30 spam mails a minute (!!), I have found this topic. I believe I am suffering an Open Relay problem with my ZCS 8 mail server.

After running a test in Open Relay Test I got the following results:

[Method 0]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@mailradar.com>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 1]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@mailradar.com>
<<< 250 2.1.0 Ok
>>> RCPT TO: relaytest@mailradar.com
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 2]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 3]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 4]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 5]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest%mailradar.com@[<<my-public-IP>>]>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 6]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest%mailradar.com.com@[<<my-public-IP>>.staticIP.rima-tde.net]>
<<< 501 5.1.3 Bad recipient address syntax
>>> QUIT
<<< 221 2.0.0 Bye
[TEST PASSED]
[Method 7]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <"relaytest@mailradar.com">
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 8]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <"relaytest%mailradar.com">
<<< 504 5.5.2 <relaytest%mailradar.com>: Recipient address rejected: need fully-qualified address
>>> QUIT
<<< 221 2.0.0 Bye
[Method 9]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com@[<<my-public-IP>>]>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 10]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <"relaytest@mailradar.com"@[<<my-public-IP>>]>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 11]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com@<<my-public-IP>>.staticIP.rima-tde.net>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 12]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <@[<<my-public-IP>>]:relaytest@mailradar.com>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 13]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <@[<<my-public-IP>>.staticIP.rima-tde.net]:relaytest@mailradar.com>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 14]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <mailradar.com!relaytest>
<<< 504 5.5.2 <mailradar.com!relaytest>: Recipient address rejected: need fully-qualified address
>>> QUIT
<<< 221 2.0.0 Bye
[Method 15]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <mailradar.com!relaytest@[<<my-public-IP>>]>
<<< 250 2.1.5 Ok
>>> QUIT
<<< 221 2.0.0 Bye
[TEST NOT PASSED]
[Method 16]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <mailradar.com!relaytest@[<<my-public-IP>>.staticIP.rima-tde.net]>
<<< 501 5.1.3 Bad recipient address syntax
>>> QUIT
<<< 221 2.0.0 Bye
[TEST PASSED]
[Method 17]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest%mailradar.com@>
<<< 504 5.5.2 <relaytest%mailradar.com@>: Recipient address rejected: need fully-qualified address
>>> QUIT
<<< 221 2.0.0 Bye
[Method 18]
<<< 220 zimbra.mydomain.com ESMTP Postfix
>>> HELO mailradar.com
<<< 250 zimbra.mydomain.com
>>> MAIL FROM: <antispam@[<<my-public-IP>>]>
<<< 250 2.1.0 Ok
>>> RCPT TO: <relaytest@mailradar.com@>
<<< 504 5.5.2 <relaytest@mailradar.com@>: Recipient address rejected: need fully-qualified address
>>> QUIT
<<< 221 2.0.0 Bye

I have replaced:
- my domain by "mydomain.com"
- my public IP address by "<<my-public-IP>>"

It seems clear I am affected by the Open Relay issue. Following instructions in this forum, I have provided:

- General Settings + MTA + trusted networks: 127.0.0.0/8 172.16.0.41/32 ---> I want autentication from all users before sending mails, even from the LAN.
- Server + MTA + trusted networks : empty ---> I guess takes settings from the General Settines (above)

Where 172.16.0.41 is my Zimbra Server Private IP address (example).

I must say that every single time I full reboot my server, I missed the trusted networks (empty field). Is that normal?

May anybody help me to fix it?


Many thanks in advance.
PS: my mail server connects to Internet via a firewall.

[JMoreno]

I believe there is a minor bug in ZCS 8.

If I provide the "Trusted networks" (127.0.0.0/8 172.16.0.41/32) at the "General Settings + MTA" level, it disapears after booting the server. But, if I set it at the server level, it remains and it starts behaving as expected (stoping the Open Relay issue).

After a while, I realized that this is also happening for other settings.

Please correct me whether I am wrong, settings fixed at the "General settings" level should be propagated to the servers, to the extend that we do not override them in the servers configuration. Am I wrong? Did I miss anything?

Thanks for your comments and replies.
Best regards.