Hi Greg, On Thu, Mar 30, 2023 at 07:18:15AM -0400, Greg Wooledge wrote: > On Thu, Mar 30, 2023 at 12:00:01PM +0300, Reco wrote: > > On Thu, Mar 30, 2023 at 09:30:49AM +0100, Julian Gilbey wrote: > > > I wonder if anyone has any idea about how to track this down? > > > > I'd check /var/log/exim4/mainlog first, obviously. > > In addition to that, open one of the spam messages in a competent MUA > and examine the full headers. You should see one or more "Received:" > headers. Every time the message is handed off to a new MTA, a new > Received: header is prepended to the top of the message, so to read > them in chronological order, you have to start at the bottom and work > your way upward. > [...]
Thanks - this was useful, and eventually helped me to pin-point the source of the spam. Best wishes, Julian
