Zimbra offers Open Source email server software and shared calendar for Linux and the Mac
Go Back   Zimbra :: Forums > Zimbra Collaboration Suite > Administrators

Welcome to the Zimbra :: Forums!
Welcome, if you would like to post a comment please register. We also encourage you to explore all things Zimbra with our team and members of the community.

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #1 (permalink)  
Old 12-09-2011, 10:15 PM
Intermediate Member
 
Posts: 15
Post Receiving failure delivery messages.

Hi,

From today morning many users receiving a "Delivery Status Notification (Failure)" messages even through they have not sent any email to those ids. User also receiving a messages of " Mail delivery failed: returning message to sender " & "Delivery Status Notification (Failure) "

I don't what happen suddenly, could somebody help me out about how to debug the issue.

I have checked on forum but nothing found related to this, as per forum i only checked relay part which i am not using external relay.

I have attached some emails received to users.

Details


Return-Path: nilesh.dand@marathonrealty.com
Received: from mail.marathonrealty.com (LHLO mail.marathonrealty.com)
(192.168.0.1) by mail.marathonrealty.com with LMTP; Sat, 10 Dec 2011
11:03:11 +0530 (IST)
Received: from localhost (localhost [127.0.0.1])
by mail.marathonrealty.com (Postfix) with ESMTP id 894331323895
for <pradip.thite@marathonrealty.com>; Sat, 10 Dec 2011 11:03:11 +0530 (IST)
X-Virus-Scanned: amavisd-new at marathonrealty.com
X-Spam-Flag: NO
X-Spam-Score: -2.909
X-Spam-Level:
X-Spam-Status: No, score=-2.909 tagged_above=-10 required=6.6
tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, HTML_MESSAGE=0.001,
T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.marathonrealty.com ([127.0.0.1])
by localhost (mail.marathonrealty.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 0P0KPp0nV48E for <pradip.thite@marathonrealty.com>;
Sat, 10 Dec 2011 11:03:10 +0530 (IST)
Received: from mail.marathonrealty.com (mail.marathonrealty.com [192.168.0.1])
by mail.marathonrealty.com (Postfix) with ESMTP id C98C41322D67
for <pradip.thite@marathonrealty.com>; Sat, 10 Dec 2011 11:03:10 +0530 (IST)
Date: Sat, 10 Dec 2011 11:03:10 +0530 (IST)
From: Nilesh Dand <nilesh.dand@marathonrealty.com>
To: Pradip Thite <pradip.thite@marathonrealty.com>
Subject: Fwd: Delivery Status Notification (Failure)
Message-ID: <60ff4229-758f-4878-b7d7-812a634c6561@mail.marathonrealty.com>
In-Reply-To: <lLgz65xME00000d75@as39ucsex01.as39.navy.mil>
Content-Type: multipart/alternative;
boundary="=_09b6048e-406c-4ac8-aaee-206099edd9b4"
MIME-Version: 1.0
X-Originating-IP: [192.168.2.152]
X-Mailer: Zimbra 7.1.2_GA_3268 (ZimbraWebClient - FF3.0 (Win)/7.1.2_GA_3268)

--=_09b6048e-406c-4ac8-aaee-206099edd9b4
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit



----- Forwarded Message -----

From: postmaster@as39.navy.mil
To: finance@marathonrealty.com
Sent: Saturday, December 10, 2011 11:02:41 AM
Subject: Delivery Status Notification (Failure)

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

debrown@as39.navy.mil





--=_09b6048e-406c-4ac8-aaee-206099edd9b4
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Times New Roman; font-size: 12pt; color: #000000'><br><br><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>postmaster@as39.navy.mil<br><b>To: </b>finance@marathonrealty.com<br><b>Sent: </b>Saturday, December 10, 2011 11:02:41 AM<br><b>Subject: </b>Delivery Status Notification (Failure)<br><br>This is an automatically generated Delivery Status Notification.<br><br>Delivery to the following recipients failed.<br><br>&nbsp;&nbsp; &nbsp; &nbsp; debrown@as39.navy.mil<br><br><br><br></div><br></div></body></html>
--=_09b6048e-406c-4ac8-aaee-206099edd9b4--
Attached Files
File Type: zip Fwd.zip (89.1 KB, 0 views)
Reply With Quote
  #2 (permalink)  
Old 12-09-2011, 11:53 PM
Zimbra Consultant & Moderator
 
Posts: 20,315
Default

It's called NDR spam, do some research on what it is and search the forums (and the wiki for some improvements you can make to the anti-spam system) for details on what you can do to reduce it.
__________________
Regards


Bill
Reply With Quote
  #3 (permalink)  
Old 12-10-2011, 12:39 AM
Intermediate Member
 
Posts: 15
Default

If it is NDR then is this required to disable or correct the account which is compromised. Could you please explain what exactly is NDR and how & for what it really works?
Reply With Quote
  #4 (permalink)  
Old 12-10-2011, 02:32 AM
Zimbra Consultant & Moderator
 
Posts: 20,315
Default

Quote:
Originally Posted by pradip View Post
If it is NDR then is this required to disable or correct the account which is compromised.
Who said it's a compromised account? If you've determined that it's a compromised account you need to take remedial steps.

Quote:
Originally Posted by pradip View Post
Could you please explain what exactly is NDR and how & for what it really works?
I've already given you a link to explain what it is and there are article in the forums and wiki on how to stop NDR spam and how to improve the ant-spam system, search for them and read what you need to do.
__________________
Regards


Bill
Reply With Quote
Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


Similar Threads

Why Join?

Registering let's you ask questions, makes it easier to search, displays any files attached to posts, and notifies you about replies.

blog.zimbra.com




 

SEO by vBSEO ©2011, Crawlability, Inc.