Hello,
I found an e-mail in the deferred queue
ran the command "mailq" as user zimbra and got the following
Ran the following command(s) as root, and got the following:Code:[zimbra@mail ~]$ mailq -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- 2CF566D58289 7050 Wed Sep 7 06:17:47 MAILER-DAEMON (host smtp-02.tld.t-online.de[194.25.134.12] refused to talk to me: 554 IP=24.234.49.118 - A problem occurred. (Ask your postmaster for help or to contact tosa@rx.t-online.de to clarify.) (BL))
(changed pertinent info regarding our domain)
the user "atomic@mydomain.com" and "atomic@mydomain.tv" do not exist.Code:[root@mail log]# /opt/zimbra/postfix/sbin/postcat /opt/zimbra/data/postfix/spool/deferred/2/2CF566D58289 *** ENVELOPE RECORDS /opt/zimbra/data/postfix/spool/deferred/2/2CF566D58289 *** message_size: 7050 243 1 0 7050 message_arrival_time: Wed Sep 7 06:17:47 2011 create_time: Wed Sep 7 06:17:47 2011 named_attribute: log_message_origin=local named_attribute: trace_flags=0 sender: original_recipient: vic2@wmymv47z7.homepage.t-online.de recipient: vic2@wmymv47z7.homepage.t-online.de *** MESSAGE CONTENTS /opt/zimbra/data/postfix/spool/deferred/2/2CF566D58289 *** Received: by mail.mydomain.com (Postfix) id 2CF566D58289; Wed, 7 Sep 2011 06:17:47 -0700 (PDT) Date: Wed, 7 Sep 2011 06:17:47 -0700 (PDT) From: MAILER-DAEMON@mail.mydomain.com (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: vic2@wmymv47z7.homepage.t-online.de Auto-Submitted: auto-replied MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="EDCDC6D58288.1315401467/mail.mydomain.com" Content-Transfer-Encoding: 7bit Message-Id: <20110907131747.2CF566D58289@mail.mydomain.com> This is a MIME-encapsulated message. --EDCDC6D58288.1315401467/mail.mydomain.com Content-Description: Notification Content-Type: text/plain; charset=us-ascii This is the mail system at host mail.mydomain.com. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <atomic@mydomain.com>: mydomain.com --EDCDC6D58288.1315401467/mail.mydomain.com Content-Description: Delivery report Content-Type: message/delivery-status Reporting-MTA: dns; mail.mydomain.com X-Postfix-Queue-ID: EDCDC6D58288 X-Postfix-Sender: rfc822; vic2@wmymv47z7.homepage.t-online.de Arrival-Date: Wed, 7 Sep 2011 06:17:46 -0700 (PDT) Final-Recipient: rfc822; atomic@mydomain.com Original-Recipient: rfc822;atomic@mydomain.tv Action: failed Status: 5.0.0 Diagnostic-Code: X-Postfix; mydomain.com --EDCDC6D58288.1315401467/mail.mydomain.com Content-Description: Undelivered Message Content-Type: message/rfc822 Content-Transfer-Encoding: 7bit Return-Path: <vic2@wmymv47z7.homepage.t-online.de> Received: from localhost (localhost.localdomain [127.0.0.1]) by mail.mydomain.com (Postfix) with ESMTP id EDCDC6D58288 for <atomic@mydomain.com>; Wed, 7 Sep 2011 06:17:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at mydomain.com X-Spam-Flag: YES X-Spam-Score: 13.462 X-Spam-Level: ************* X-Spam-Status: Yes, score=13.462 tagged_above=-10 required=6.6 tests=[BAYES_99=3.5, DECEASED_NO_ML=0.001, FILL_THIS_FORM=0.001, FILL_THIS_FORM_LONG=3.404, FORGED_MUA_OUTLOOK=1.927, FSL_CTYPE_WIN1251=3.4, LOTS_OF_MONEY=0.001, MONEY_FORM=0.001, NSL_RCVD_FROM_USER=1.226, RCVD_IN_DNSWL_NONE=-0.0001, UNPARSEABLE_RELAY=0.001] autolearn=no Received: from mail.mydomain.com ([127.0.0.1]) by localhost (mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ax9Rd866kVZz for <atomic@mydomain.com>; Wed, 7 Sep 2011 06:17:45 -0700 (PDT) Received: from mailout02.t-online.de (mailout02.t-online.de [194.25.134.17]) by mail.mydomain.com (Postfix) with ESMTP id 7A8CB6D58287 for <atomic@atomic.tv>; Wed, 7 Sep 2011 06:17:44 -0700 (PDT) Received: from fwd22.aul.t-online.de (fwd22.aul.t-online.de ) by mailout02.t-online.de with smtp id 1R1HDH-0006ZT-Bc; Wed, 07 Sep 2011 14:26:43 +0200 Received: from User (Vg-mGcZcwtMT811ODdwiRLDsAim3XLe+yNwX85aNv8ed8CLISrr3Ac2b7kgVigzQWeogTewH5P@[24.106.194.46]) by fwd22.t-online.de with esmtp id 1R1Gzl-1JlZei0; Wed, 7 Sep 2011 14:12:45 +0200 Reply-To: <deborahhut@gmail.com> From: "Deborah Hutchinson" <vic2@wmymv47z7.homepage.t-online.de> Subject: --SPAM--GREETINGS Date: Wed, 7 Sep 2011 08:11:27 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook Express 6.00.2600.0000 Message-ID: <1R1Gzl-1JlZei0@fwd22.t-online.de> X-WatchGuard-IPS: message checked X-WatchGuard-Spam-ID: str=0001.0A0B0209.4E676ED3.0048,ss=1,fgs=0 X-WatchGuard-Spam-Score: 0, clean; 0, no virus X-WatchGuard-Mail-Client-IP: 194.25.134.17 X-WatchGuard-Mail-From: vic2@wmymv47z7.homepage.t-online.de X-WatchGuard-Mail-Recipients: atomic@mydomain.tv X-WatchGuard-AntiVirus: part scanned. clean action=allow To: undisclosed-recipients:; Greetings in the name of the lord, <I deleted remainder of message for posting here> --EDCDC6D58288.1315401467/mail.mydomain.com-- *** HEADER EXTRACTED /opt/zimbra/data/postfix/spool/deferred/2/2CF566D58289 *** *** MESSAGE FILE END /opt/zimbra/data/postfix/spool/deferred/2/2CF566D58289 *** [root@mail log]#
mydomain.tv is an alias to mydomain.com
a Watchguard firewall/ips/antispam/antivirus applicance sits upstream
of the mail server / LAN
So, this is NDR spam, correct? If not, what exactly is it?
What steps / actions / methods can I take to keep this from happening?
Again - fairly new to the world of *nix and Zimbra.
Detailed explanations of how to proceed would be most appreciated.
thank you very much


LinkBack URL
About LinkBacks

