External Domain Account in Zimbra Sender list?

[bhwong]

I notice that in Zimbra mail queues, there are senders who do not have any account in Zimbra at all. Why is it that they can use our Zimbra to send out email? Is this normal?

[y@w]

There's a few things that can allow that.. Users can add personas to their accounts right in the web client with whatever address they want if the checkbox is checked in the admin console for their user. They can also do the same from their mail clients. There's also the possibility that some server in your trusted networks is using it as a relay. (there are plenty more possibilities)

Most importantly, you'll want to make sure you're not an open relay to the world. I'd recommend this tool.

[bhwong]

Our Zimbra is not an open relay and the usage of personas is unlikely because these appears to be some valid accounts from external parties:

xxxmagazine@gmail.com
xxx@luxasia.com
xxx@mailnaritlaw.com

[phoenix]

Originally Posted by bhwong

Our Zimbra is not an open relay and the usage of personas is unlikely because these appears to be some valid accounts from external parties:

Feel free to search the internet for details of 'backscatter' or 'NDR' spam or perhaps some of the many forum threads or wiki articles that detail what you can do to limit this problem.'