Hi,
Anyone at Google interested in stopping some backscatter?
It looks like a failed relay attempt gets converted into a DSN.
I just got a third one that’s similar to the pattern below. Redacted to just
get the idea across.
Copies available on request.
SPF & DKIM pass as reported by Gmail for the DSN.
From: Mail Delivery Subsystem <mailer-dae...@googlemail.com>
Subject: Delivery Status Notification (Failure)
...
Your message wasn't delivered to gmailu...@google.com because the address
couldn't be found, or is unable to receive mail.
...
Reporting-MTA: dns; googlemail.com
Received-From-MTA: dns; redac...@gmail.com
Arrival-Date: Mon, 11 Aug 2025 REDACTED (PDT)
X-Original-Message-ID: <randomj...@notgoogle.de>
...
Final-Recipient: rfc822; gmailu...@google.com
...
Return-Path: <gmailu...@gmail.com>
Received: from NOTGOOGLE.org ([IP.ADD.RE.SS])
by mx.google.com with ESMTPS id REDACTED_UNIQUEID
for <gmailu...@google.com>
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Mon, 11 Aug 2025 REDACTED (PDT)
Received-SPF: softfail (google.com: domain of transitioning gmailu...@gmail.com
does not designate IP.ADD.RE.SS as permitted sender) client-ip=IP.ADD.RE.SS;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning gmailu...@gmail.com
does not designate IP.ADD.RE.SS as permitted sender)
smtp.mailfrom=gmailu...@gmail.com
...
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Subject:
To: <gmailu...@gmail.com>
Precedence: bulk
From:<redac...@notgoogle.com>
Message-ID: <randomj...@notgoogle.de>
X-Mailer: CustomMailer/1.0
List-Unsubscribe: <https://SCAMDOMAIN.com/unsubscribe?id=RANDOM>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
This is followed by a body with an inline image.png that’s wrapped with an
“<AREA HREF=“ that points to an AWS host.
Thanks,
—Steve
_______________________________________________
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop
