block email

[madunix]

i keep getting email from non existing users on my domain, how can i block them?
such as
none@domain.com

[ewilen]

Please post the output of

zmcontrol -v

into your user profile.

And then also post the full headers from one or more of these emails.

[madunix]

Return-Path: adminBugGenie@xxxdomain.com
Received: from imail.xxx.com(LHLO imail.xxx.com) (10.5.1.35) by
imail.xxx.com with LMTP; Tue, 10 Aug 2010 16:10:52 +0300 (EEST)
Received: from localhost (localhost.localdomain [127.0.0.1])
by imail.xxx.com (Postfix) with ESMTP id 5ADC72DC0C0
for <why@xxxdomain.com>; Tue, 10 Aug 2010 16:10:52 +0300 (EEST)
X-Virus-Scanned: amavisd-new at
Received: from imail.xxx.com ([127.0.0.1])
by localhost (imail.xxx.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id PMbM2MMjvL8X for <why@xxxdomain.com>;
Tue, 10 Aug 2010 16:10:52 +0300 (EEST)
Received: from WEB-UPDATE (unknown [10.6.30.120])
by imail.xxx.com (Postfix) with SMTP id 2E7C92DC0B0
for <why@xxxdomain.com>; Tue, 10 Aug 2010 16:10:52 +0300 (EEST)
Date: Tue, 10 Aug 2010 11:53:03 +0000
Subject: Test email
To: why@xxxdomain.com
From: The Bug Genie 2 Automailer <adminBugGenie@xxxdomain.com>
Message-Id: <20100810131052.2E7C92DC0B0@imail.xxx.com>
X-EsetId: D51E7528B2C77369CA18757CBF9635


The mail server i built it woks as intranet mail server and external mail serveer, the problem is the some accounts are not been created intranet can send to other accounts such as adminBugGenie@xxxdomain.com (does not exist)

[ewilen]

I'm guessing that you are using the private range 10.6.0.0/8 for part of your intranet and that this is in your Zimbra trusted networks. Under this scenario, Zimbra will accept any SMTP connection from addresses in that range, without authentication, and they can use whatever they want as the From: address and smtp envelope sender.

What you should do is just track down the machine with ip address in the first (bottom-most) received line and find out why they're sending mail. Are they infected? Has the owner configured them to use Zimbra as the SMTP server for something they've set up? (E.g., do they have The Bug Genie - friendly issue tracking installed?)

To track down the machine, it might be helpful to use a tool such as nmap, Angry IP Scanner : Home - IP and Port Scanner Tool for Analyzing Networks, or (in a Windows domain environment) nbtstat.

[madunix]

you have a point, but even if its a trusted network can i force the authentication?

[ewilen]

The definition of a trusted network is one that does not enforce authentication. If you want to require authentication for everybody, just change the setting in the Admin GUI > Configuration > Servers > your server > MTA > MTA Trusted Networks.

That said, your mail server will typically accept mail from any network, with or without authentication. But once you change the above setting, non-authenticated mail should at least be subject to higher scrutiny by SpamAssassin (e.g. it won't get the ALL_TRUSTED score or the SASL_AUTHENTICATED_SENDER score).