Results 1 to 2 of 2

Thread: e-mail in deferred - NDR Spam? If not, what is it / why is it?

  1. #1
    billinvegas's Avatar
    billinvegas is offline Active Member
    Join Date
    Jun 2011
    Location
    Sin City
    Posts
    38
    Rep Power
    4

    Default e-mail in deferred - NDR Spam? If not, what is it / why is it?

    Hello,
    I found an e-mail in the deferred queue

    ran the command "mailq" as user zimbra and got the following

    Code:
    [zimbra@mail ~]$ mailq
    -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
    2CF566D58289     7050 Wed Sep  7 06:17:47  MAILER-DAEMON
    (host smtp-02.tld.t-online.de[194.25.134.12] refused to talk to me: 554 IP=24.234.49.118 - A problem occurred. (Ask your postmaster for help or to contact tosa@rx.t-online.de to clarify.) (BL))
    Ran the following command(s) as root, and got the following:
    (changed pertinent info regarding our domain)

    Code:
    [root@mail log]# /opt/zimbra/postfix/sbin/postcat /opt/zimbra/data/postfix/spool/deferred/2/2CF566D58289
    *** ENVELOPE RECORDS /opt/zimbra/data/postfix/spool/deferred/2/2CF566D58289 ***
    message_size:            7050             243               1               0            7050
    message_arrival_time: Wed Sep  7 06:17:47 2011
    create_time: Wed Sep  7 06:17:47 2011
    named_attribute: log_message_origin=local
    named_attribute: trace_flags=0
    sender: 
    original_recipient: vic2@wmymv47z7.homepage.t-online.de
    recipient: vic2@wmymv47z7.homepage.t-online.de
    *** MESSAGE CONTENTS /opt/zimbra/data/postfix/spool/deferred/2/2CF566D58289 ***
    Received: by mail.mydomain.com (Postfix)
    	id 2CF566D58289; Wed,  7 Sep 2011 06:17:47 -0700 (PDT)
    Date: Wed,  7 Sep 2011 06:17:47 -0700 (PDT)
    From: MAILER-DAEMON@mail.mydomain.com (Mail Delivery System)
    Subject: Undelivered Mail Returned to Sender
    To: vic2@wmymv47z7.homepage.t-online.de
    Auto-Submitted: auto-replied
    MIME-Version: 1.0
    Content-Type: multipart/report; report-type=delivery-status;
    	boundary="EDCDC6D58288.1315401467/mail.mydomain.com"
    Content-Transfer-Encoding: 7bit
    Message-Id: <20110907131747.2CF566D58289@mail.mydomain.com>
    
    This is a MIME-encapsulated message.
    
    --EDCDC6D58288.1315401467/mail.mydomain.com
    Content-Description: Notification
    Content-Type: text/plain; charset=us-ascii
    
    This is the mail system at host mail.mydomain.com.
    
    I'm sorry to have to inform you that your message could not
    be delivered to one or more recipients. It's attached below.
    
    For further assistance, please send mail to postmaster.
    
    If you do so, please include this problem report. You can
    delete your own text from the attached returned message.
    
                       The mail system
    
    <atomic@mydomain.com>: mydomain.com
    
    --EDCDC6D58288.1315401467/mail.mydomain.com
    Content-Description: Delivery report
    Content-Type: message/delivery-status
    
    Reporting-MTA: dns; mail.mydomain.com
    X-Postfix-Queue-ID: EDCDC6D58288
    X-Postfix-Sender: rfc822; vic2@wmymv47z7.homepage.t-online.de
    Arrival-Date: Wed,  7 Sep 2011 06:17:46 -0700 (PDT)
    
    Final-Recipient: rfc822; atomic@mydomain.com
    Original-Recipient: rfc822;atomic@mydomain.tv
    Action: failed
    Status: 5.0.0
    Diagnostic-Code: X-Postfix; mydomain.com
    
    --EDCDC6D58288.1315401467/mail.mydomain.com
    Content-Description: Undelivered Message
    Content-Type: message/rfc822
    Content-Transfer-Encoding: 7bit
    
    Return-Path: <vic2@wmymv47z7.homepage.t-online.de>
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by mail.mydomain.com (Postfix) with ESMTP id EDCDC6D58288
    	for <atomic@mydomain.com>; Wed,  7 Sep 2011 06:17:46 -0700 (PDT)
    X-Virus-Scanned: amavisd-new at mydomain.com
    X-Spam-Flag: YES
    X-Spam-Score: 13.462
    X-Spam-Level: *************
    X-Spam-Status: Yes, score=13.462 tagged_above=-10 required=6.6
    	tests=[BAYES_99=3.5, DECEASED_NO_ML=0.001, FILL_THIS_FORM=0.001,
    	FILL_THIS_FORM_LONG=3.404, FORGED_MUA_OUTLOOK=1.927,
    	FSL_CTYPE_WIN1251=3.4, LOTS_OF_MONEY=0.001, MONEY_FORM=0.001,
    	NSL_RCVD_FROM_USER=1.226, RCVD_IN_DNSWL_NONE=-0.0001,
    	UNPARSEABLE_RELAY=0.001] autolearn=no
    Received: from mail.mydomain.com ([127.0.0.1])
    	by localhost (mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id ax9Rd866kVZz for <atomic@mydomain.com>;
    	Wed,  7 Sep 2011 06:17:45 -0700 (PDT)
    Received: from mailout02.t-online.de (mailout02.t-online.de [194.25.134.17])
    	by mail.mydomain.com (Postfix) with ESMTP id 7A8CB6D58287
    	for <atomic@atomic.tv>; Wed,  7 Sep 2011 06:17:44 -0700 (PDT)
    Received: from fwd22.aul.t-online.de (fwd22.aul.t-online.de )
    	by mailout02.t-online.de with smtp 
    	id 1R1HDH-0006ZT-Bc; Wed, 07 Sep 2011 14:26:43 +0200
    Received: from User (Vg-mGcZcwtMT811ODdwiRLDsAim3XLe+yNwX85aNv8ed8CLISrr3Ac2b7kgVigzQWeogTewH5P@[24.106.194.46]) by fwd22.t-online.de
    	with esmtp id 1R1Gzl-1JlZei0; Wed, 7 Sep 2011 14:12:45 +0200
    Reply-To: <deborahhut@gmail.com>
    From: "Deborah Hutchinson" <vic2@wmymv47z7.homepage.t-online.de>
    Subject: --SPAM--GREETINGS
    Date: Wed, 7 Sep 2011 08:11:27 -0400
    MIME-Version: 1.0
    Content-Type: text/plain;
    	charset="Windows-1251"
    Content-Transfer-Encoding: 7bit
    X-Mailer: Microsoft Outlook Express 6.00.2600.0000
    Message-ID: <1R1Gzl-1JlZei0@fwd22.t-online.de>
    X-WatchGuard-IPS: message checked
    X-WatchGuard-Spam-ID: str=0001.0A0B0209.4E676ED3.0048,ss=1,fgs=0
    X-WatchGuard-Spam-Score: 0, clean; 0, no virus
    X-WatchGuard-Mail-Client-IP: 194.25.134.17
    X-WatchGuard-Mail-From: vic2@wmymv47z7.homepage.t-online.de
    X-WatchGuard-Mail-Recipients: atomic@mydomain.tv
    X-WatchGuard-AntiVirus: part scanned. clean action=allow
    To: undisclosed-recipients:;
    
    Greetings in the name of the lord,
    
    <I deleted remainder of message for posting here>
    
    --EDCDC6D58288.1315401467/mail.mydomain.com--
    *** HEADER EXTRACTED /opt/zimbra/data/postfix/spool/deferred/2/2CF566D58289 ***
    *** MESSAGE FILE END /opt/zimbra/data/postfix/spool/deferred/2/2CF566D58289 ***
    [root@mail log]#
    the user "atomic@mydomain.com" and "atomic@mydomain.tv" do not exist.

    mydomain.tv is an alias to mydomain.com

    a Watchguard firewall/ips/antispam/antivirus applicance sits upstream
    of the mail server / LAN


    So, this is NDR spam, correct? If not, what exactly is it?

    What steps / actions / methods can I take to keep this from happening?

    Again - fairly new to the world of *nix and Zimbra.
    Detailed explanations of how to proceed would be most appreciated.

    thank you very much
    Release 7.1.1_GA_3196.RHEL5_64_20110527011124 CentOS5_64 FOSS edition

  2. #2
    billinvegas's Avatar
    billinvegas is offline Active Member
    Join Date
    Jun 2011
    Location
    Sin City
    Posts
    38
    Rep Power
    4

    Default

    zmmta.cf setting

    Code:
    POSTCONF smtpd_reject_unlisted_recipient            yes
    Release 7.1.1_GA_3196.RHEL5_64_20110527011124 CentOS5_64 FOSS edition

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Replies: 8
    Last Post: 04-10-2011, 09:14 AM
  2. Replies: 7
    Last Post: 02-03-2011, 07:01 AM
  3. Help mail server broadcast spam
    By sh1n_b3 in forum Administrators
    Replies: 0
    Last Post: 01-19-2011, 07:44 PM
  4. Problem with Postfix and MTA
    By ZMilton in forum Administrators
    Replies: 16
    Last Post: 04-16-2008, 06:47 AM
  5. [SOLVED] Mailserver down when send file attach of 50Mb
    By ZMilton in forum Administrators
    Replies: 20
    Last Post: 04-10-2008, 11:44 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •