Carlos Williams wrote:
On Mon, Mar 30, 2009 at 2:32 PM, Noel Jones <[email protected]> wrote:
It appears the QUEUEID you want to look for is A94B31FA4DA0.
That should be listed in the first (reading up from the bottom) Received
header in the message.
I searched and found what is listed below. Are you saying that reads
from bottom to top? Is this even what I am looking for to help
understand my issue?
mail:~# grep A94B31FA4DA0 /var/log/mail.log
Mar 30 10:33:01 mail postfix/smtpd[15411]: A94B31FA4DA0:
client=localhost[127.0.0.1]
OK, it's sent from the local machine. Apparently this is
still after the content_filter.
Mar 30 10:33:01 mail postfix/cleanup[14524]: A94B31FA4DA0:
message-id=<01c9b172$81de7e00$cd05a...@teemigh>
Mar 30 10:33:01 mail postfix/qmgr[2680]: A94B31FA4DA0:
from=<[email protected]>, size=2140, nrcpt=1 (queue active)
Mar 30 10:33:01 mail amavis[15415]: (15415-10) FWD via SMTP:
<[email protected]> -> <[email protected]>, 250 2.6.0 Ok,
id=15415-10, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as
A94B31FA4DA0
Mar 30 10:33:01 mail amavis[15415]: (15415-10) Passed SPAMMY,
[59.165.5.205] [59.165.5.205] <[email protected]> ->
<[email protected]>, Message-ID:
<01c9b172$81de7e00$cd05a...@teemigh>, mail_id: x9wUuMu35-4A, Hits:
16.926, queued_as: A94B31FA4DA0, 8288 ms
The [59.165.5.205] logged by amavisd is likely the original IP
address.
That IP is currently listed in both spamcop and zen, but may
not have been listed yet when you checked.
It would be helpful if you could post the full headers.
Mar 30 10:33:01 mail postfix/smtp[15341]: 910AA1FA4D9E:
to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024,
delay=9.4, delays=1.1/0/0/8.3, dsn=2.6.0, status=sent (250 2.6.0 Ok,
id=15415-10, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as
A94B31FA4DA0)
Ah, here's the line we need. Looks as if the prior QUEUEID is
910AA1FA4D9E. Time to search the logs for that...
Can you post the full unaltered headers of the message?
Change the username part of mail addresses to protect privacy.
BTW, consider restricting access to "everyone" or other easily-guessed list
names using something similar to this example:
http://www.postfix.org/RESTRICTION_CLASS_README.html#internal
Well I am implementing Mailman on my server next week which does not
permit non-subscribed addresses to pass through without approval.
Obviously those would be denied. Should I still consider doing the
mentioned above if I plan to implement Mailman on my Postfix server?
I believe mailman will "bounce" unauthorized postings, which
can create backscatter (expect a correction within minutes if
I'm wrong about that). Send enough backscatter and you'll get
blacklisted.
Much better to have postfix reject mail you don't want during
SMTP.
-- Noel Jones
