Strange .. This server is also used as outgoing mailserver ? You are sure they don't use another mailserver for sending out mail ?
[EMAIL PROTECTED] wrote: > This is possibly the weirdest problem I have ever seen with > qmail/qmail-scanner. So, we took down the mail server, removed queue/, > build a new queue/ using 'make setup check', restarted mail. It happened > again. At this point I'm at a loss. > > Why would qmail and/or qmail-scanner randomly insert an extra recip? It > just doesn't make sense to me, but it's happening and we are getting the > bounces to prove it. (No, it's not a spoof. The bounces include the text > that the sender originally sent out in an email.) > > Any ideas? > > We are literally going to have to move this client to another mail > server running something else, which we really can't afford to do but I > don't see any other solutions. > > Any help is appreciated! > > [EMAIL PROTECTED] wrote: > >> We are running qmail-1.03 on RH7.3 with vpopmail-5.2.1 and >> qmail-scanner-1.25. We have an odd problem. It seems that sometimes >> when a user sends a mail with a Cc: to himself (and it may also be the >> To:, but we don't have an examples), that user sometimes gets a bounce >> from our qmail server for an address that the user didn't specify. For >> example, let's say that user A sends this email: >> >> From: bob >> To: sam >> Cc: bob >> >> (I did a lot of copy&pasting to ensure I provided a lot of detail. So >> please scroll all the way down, thanks!) >> >> An as a note, the "unintended" recipient will be named >> "[EMAIL PROTECTED]". The unintended recipient appears random though. >> Sometimes it may be [EMAIL PROTECTED], etc. The addresses >> look like fake spammer addresses to me. >> >> Then every once in a while bob will get this bounce: >> >> ... >> -----Original Message----- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] >> Sent: Wednesday, August 10, 2005 2:26 AM >> To: [EMAIL PROTECTED] >> Subject: failure notice >> >> >> Hi. This is the qmail-send program at server.mydomain.com. I'm >> afraid I wasn't able to deliver your message to the following addresses. >> This is a permanent error; I've given up. Sorry it didn't work out. >> >> <[EMAIL PROTECTED]>: >> 64.97.131.1 does not like recipient. >> Remote host said: 550 RCPT TO:<[EMAIL PROTECTED]> User unknown Giving >> up on 64.97.131.1. >> >> --- Below this line is a copy of the message. >> Return-Path: <[EMAIL PROTECTED]> >> Received: (qmail 15860 invoked by uid 508); 10 Aug 2005 09:26:25 -0000 >> Delivered-To: [EMAIL PROTECTED] >> Received: (qmail 15857 invoked by uid 532); 10 Aug 2005 09:26:25 -0000 >> Received: from 66.60.130.50 by server.mydomain.com >> (envelope-from <[EMAIL PROTECTED]>, uid 501) with >> qmail-scanner-1.25 >> (clamdscan: 0.84/1010. spamassassin: 2.64. >> Clear:RC:0(66.60.130.50):SA:0(5.8/6.3):. >> Processed in 3.417484 secs); 10 Aug 2005 09:26:25 -0000 >> X-Spam-Status: No, hits=5.8 required=6.3 >> X-Spam-Level: +++++ >> Received: from unknown (HELO smtp1.mc.surewest.net) (66.60.130.50) >> by my.ip.ad.rr with SMTP; 10 Aug 2005 09:26:21 -0000 >> Received: (s3-8911); Wed, 10 Aug 2005 02:29:24 -0700 >> Received: from unknown (65.78.187.126) >> by smtp1.mc.surewest.net (s3-smtpd/0.90-beta3) with SMTP; Wed, 10 Aug >> 2005 02:29:22 -0700 >> From: "Bob" <[EMAIL PROTECTED]> >> To: "'Sam'" <[EMAIL PROTECTED]> >> Cc: "Bob" <[EMAIL PROTECTED]> >> Subject: RE: How do you mark a call as an EDU? >> Date: Wed, 10 Aug 2005 02:29:35 -0700 >> Message-ID: <[EMAIL PROTECTED]> >> MIME-Version: 1.0 >> Content-Type: multipart/alternative; >> boundary="----=_NextPart_000_001D_01C59D53.59DFE920" >> X-Priority: 3 (Normal) >> X-MSMail-Priority: Normal >> X-Mailer: Microsoft Outlook, Build 10.0.2627 >> Importance: Normal >> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 >> In-Reply-To: >> X-TST: smtp1 SNWK3 0.31-80 ip=65.78.187.126 >> >> This is a multi-part message in MIME format. >> ... >> >> Now, here is our smtpd log for [EMAIL PROTECTED]: >> >> /var/log/qmail/smtpd/: >> >> [EMAIL PROTECTED] /var/log/qmail/smtpd]# grep -i [EMAIL PROTECTED] * | >> tai64nlocal >> 2005-08-10 05:43:31.066396500.s:@4000000042f9c8300dbc70fc info msg >> 1540461: bytes 3566 from <[EMAIL PROTECTED]> qp 15536 uid 532 >> 2005-08-10 05:43:31.066396500.s:@4000000042f9c83012eb028c starting >> delivery 27931: msg 1540532 to remote [EMAIL PROTECTED] >> 2005-08-10 05:43:31.066396500.s:@4000000042f9c8320f4f7cac starting >> delivery 27935: msg 1540532 to remote [EMAIL PROTECTED] >> 2005-08-10 05:43:31.066396500.s:@4000000042f9c837008fb31c delivery >> 27931: failure: >> 64.97.131.1_does_not_like_recipient./Remote_host_said:_550_RCPT_TO:<[EMAIL >> PROTECTED]>_User_unknown/Giving_up_on_64.97.131.1./ >> >> 2005-08-10 05:43:31.066396500.s:@4000000042f9c83736b04074 delivery >> 27935: failure: >> 64.97.131.1_does_not_like_recipient./Remote_host_said:_550_RCPT_TO:<[EMAIL >> PROTECTED]>_User_unknown/Giving_up_on_64.97.131.1./ >> >> >> And the send log: >> >> [EMAIL PROTECTED] send]# grep -i '[EMAIL PROTECTED]' * | tai64nlocal >> 2005-08-10 05:43:31.066396500.s:@4000000042f9c8300dbc70fc info msg >> 1540461: bytes 3566 from <[EMAIL PROTECTED]> qp 15536 uid 532 >> 2005-08-10 05:43:31.066396500.s:@4000000042f9c83012eb028c starting >> delivery 27931: msg 1540532 to remote [EMAIL PROTECTED] >> 2005-08-10 05:43:31.066396500.s:@4000000042f9c8320f4f7cac starting >> delivery 27935: msg 1540532 to remote [EMAIL PROTECTED] >> 2005-08-10 05:43:31.066396500.s:@4000000042f9c837008fb31c delivery >> 27931: failure: >> 64.97.131.1_does_not_like_recipient./Remote_host_said:_550_RCPT_TO:<[EMAIL >> PROTECTED]>_User_unknown/Giving_up_on_64.97.131.1./ >> >> 2005-08-10 05:43:31.066396500.s:@4000000042f9c83736b04074 delivery >> 27935: failure: >> 64.97.131.1_does_not_like_recipient./Remote_host_said:_550_RCPT_TO:<[EMAIL >> PROTECTED]>_User_unknown/Giving_up_on_64.97.131.1./ >> >> >> Now, there was a [EMAIL PROTECTED] that we got mail from at some point: >> >> [EMAIL PROTECTED] qmailscan]# grep -i [EMAIL PROTECTED] qmail-queue.log.1 >> Wed, 10 Aug 2005 04:25:54 CDT:15498: g_e_h: return-path is >> "[EMAIL PROTECTED]", recips is "[EMAIL PROTECTED]" >> Wed, 10 Aug 2005 04:25:54 CDT:15498: from="Mai Copeland" >> <[EMAIL PROTECTED]>,subj=If a relaxing moment turns into the right >> moment!, >> x-qmail-scanner-message-id=<[EMAIL PROTECTED]> >> via SMTP from 24.42.69.76 >> Wed, 10 Aug 2005 04:25:58 CDT:15498: qmail-scanner: >> Clear:RC:0(24.42.69.76):SA:1(9.9/6.3): 4.798779 3145 >> [EMAIL PROTECTED] [EMAIL PROTECTED] If a relaxing >> moment turns into the right moment! >> <[EMAIL PROTECTED]> >> 1123665954.15509-0.server.mydomain.com:312 >> 1123665954.15509-1.server.mydomain.com:1948 >> orig-server.mydomain.com112366595349315498:3145 >> >> So what's happening here? I can't quite figure it out. It's like qmail >> or qmail-scanner or SOMETHING is trying to deliver mail to a recip >> that it knew about for a previous email. >> >> There are two mails in qmailscan/archives/ relating to this particular >> email, one for Bob and one for Sam. >> >> >> >> ------------------------------------------------------- >> SF.Net email is Sponsored by the Better Software Conference & EXPO >> September 19-22, 2005 * San Francisco, CA * Development Lifecycle >> Practices >> Agile & Plan-Driven Development * Managing Projects & Teams * Testing >> & QA >> Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf >> _______________________________________________ >> Qmail-scanner-general mailing list >> Qmail-scanner-general@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general > > > > > ------------------------------------------------------- > SF.Net email is Sponsored by the Better Software Conference & EXPO > September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices > Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA > Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf > _______________________________________________ > Qmail-scanner-general mailing list > Qmail-scanner-general@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general ------------------------------------------------------- SF.Net email is Sponsored by the Better Software Conference & EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf _______________________________________________ Qmail-scanner-general mailing list Qmail-scanner-general@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
