On 22 May 2013, at 7:36, LuKreme wrote:
My daily run output (freebsd) sent this message (in part) for today.
Mail in submit queue:
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
27FC0118B7AF 9831 Tue May 21 14:29:35 MAILER-DAEMON
(host eforward3.registrar-servers.com[38.101.213.199] said: 450 4.1.1
<[email protected]>: Recipient address rejected: unverified
address: unknown user: "[email protected]" (in reply to RCPT TO
command))
[email protected]
45C9A118B7AD 10261 Mon May 20 19:14:02 MAILER-DAEMON
(host eforward3.registrar-servers.com[38.101.213.199] said: 450 4.1.1
<[email protected]>: Recipient
address rejected: unverified address: unknown user:
"[email protected]" (in reply to
RCPT TO command))
[email protected]
So, I go and sure enough they are in the queue.
# postsuper -h 27FC0118B7AF
postsuper: 27FC0118B7AF: placed on hold
postsuper: Placed on hold: 1 message
So I go and check the maillot for yesterday and this is what I find.
May 21 14:29:35 mail postfix/cleanup[81455]: 27FC0118B7AF:
message-id=<[email protected]>
May 21 14:29:35 mail postfix/bounce[81551]: 3F635118B777: sender
non-delivery notification: 27FC0118B7AF
May 21 14:29:35 mail postfix/qmgr[68570]: 27FC0118B7AF: from=<>,
size=9831, nrcpt=1 (queue active)
May 21 14:29:38 mail postfix/smtp[81526]: 27FC0118B7AF: host
eforward2.registrar-servers.com[209.105.246.195] said: 450 4.1.1
<[email protected]>: Recipient address rejected: unverified
address: unknown user: "[email protected]" (in reply to RCPT TO
command)
And now I'm concerned, where did this mail come from, how do I have
it, why is there no from?
27FC0118B7AF has a null envelope sender because it is a bounce of
3F635118B777. See the 2nd line?
Then there are many 450 errors which I guess are the receiver treating
unknown user as a transient error which seems odd, but that's well out
of my control.
Many systems play funny games with bounces because they can. Spammers
like andrite.com and providers who cater to them (registrar-servers.com
= NameCheap) play particularly irrational games with bounces to slip
through the cracks in some unwise spam control tactics.
The other message appears to be much the same as the first.
I'm obviously concerned there's some sir to of backscatter error, or
something else that is using my server as some sort of
relay/reflector.
Seems like a backscatter problem. The log should have lines about why
27FC0118B7AF was asynchronously bounced which will expose the root
cause.
