Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #261918

Re: Are people trying to relay mail through my system?

Show all headers | View raw

On 9/25/23 14:25, Andy Smith wrote:
> Hi Rick,
>
> Your system has rejected a spam email, not because it worked out it
> was spam, but because it was syntactically invalid. That's good, but
> unfortunately your system decided to helpfully tell the (spam)
> sender what had happened, by trying to send this bounce message
> back:
>
> On Mon, Sep 25, 2023 at 12:24:52PM -0600, Rick Macdonald wrote:
>> # exim4 -Mvb 1qkOYj-001Hnf-2V
>>
>> 1qkOYj-001Hnf-2V-D
>> --foo-mani-padme-hum-306716-2546159-1695559801
>> Content-Type: text/plain
>>
>> This message was created automatically by mail delivery software.
>>
>> A message that you sent could not be delivered to one or more of its
>> recipients. This is a permanent error.
>>
>> Reason: General SMTP/ESMTP error.
>>
>> The following address(es) failed:
>> rickm@localhost
>>     SMTP error: 550 header syntax
>>
>> --foo-mani-padme-hum-306716-2546159-1695559801
>> Content-Type: message/delivery-status
>>
>> Reporting-MTA: dns; timshel
>>
>> Final-Recipient: rfc822; rickm@localhost
>> Last-Attempt-Date: Sun, 24 Sep 2023 06:50:01 -0600 (MDT)
>> Action: failed
>> Status: 5.0.0
>> Diagnostic-Code: 550 header syntax
>>
>> --foo-mani-padme-hum-306716-2546159-1695559801
>> Content-Type: text/rfc822-headers
>>
>> X-Original-To: rickm@timshel.ca
>> Delivered-To: x2959223@pdx1-sub0-mail-mx207.dreamhost.com
>> Received: from tulsa.turntext.co (unknown [104.234.25.229])
>>      by pdx1-sub0-mail-mx207.dreamhost.com (Postfix) with ESMTP id
>> 4RtbVJ37KPz6m2v
>>      for <rickm@timshel.ca>; Sat, 23 Sep 2023 23:20:56 -0700 (PDT)
>> DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=k1; d=turntext.co;
>>   h=Mime-Version:Content-Type:Date:From:Reply-To:Subject:To:Message-ID;
>> i=WornKneeCartilage@turntext.co;
>>   bh=CBxd431jRA2owpgtRRwIfhh07HQ=;
>>   b=gHSMnk0fIYnLGQMVojCZV3z41dNcSDXALZjYjGOQIeWpdDRnH1sBJQfHSP1kzPxUfJa/crsQxxk0
>> EEY0hk6SjSg1YMK0YDqaT3OXZpz67fAgfVqbB+/ZLA7peSq+mggzKwXIfesN5AC+H7c6pFd6rOii
>>     E7T+FwmD2FKVnP6z0is=
>> DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=k1; d=turntext.co;
>>   b=FZY5bgp2/ypBd4Xc/Efzs345ind+OlkYi2NY3G5/m9tEesrUIeIGeE3JR8wlb2+gDhJDNA2BmzYx
>> 53+nwYoiSBgyl/seZvILf1Ojhxg2y0YQWVwzF4LYDunZHfOV8RsiXxhHwL+xjbcTK3zPuKvdOjRF
>>     1yRVz4iZe7AkjSr5Veo=;
>> Mime-Version: 1.0
>> Content-Type: multipart/alternative;
>> boundary="21ceb14ceae19fd582462d70f2ee8d8a"
>> Date: Sat, 23 Sep 2023 23:19:41 -0700
>> From: "Knee Hurts?" <Worn Knee Cartilage@turntext.co>
>> Reply-To: "Knee Hurts?" <Worn Knee Cartilage@turntext.co>
> One of those two are probably the headers that your Exim objects to,
> since they have spaces in the local parts of the address without
> quoting.
>
> The whole emails are of course, unwanted spam.
>
> Your other problem, and the reason you have noticed this, is that
> your smarthost does not want to accept these helpful bounce messages
> that you are generating. They are using a temporary failure code
> (451) but their mention of the "AUP" string leads me to believe that
> they may suspect the messages are spam or spam-related and want
> nothing to do with them.
>
> Either way, they are useless messages and you should stop trying
> to send them.
>
>> If my system is trying to reply tho them, should I stop it from trying to
>> reply? (Of course I don't know how to do that!)
> You can remove them from your mail queue with:
>
> # eim4 -Mrm <id>
>
> You can get the ids from the "mailq" command or reading your logs.
> You can specify multiple ids per command line.
>
> After doing that you may want to look into how you can avoid sending
> bounce messages to emails that your system doesn't want to accept.
> These bounce messages are happening outside of the original SMTP
> connection (which was between the sender and the MX for your
> domain) and are generally "too little, too late". Additionally, it
> seems like you may be sending them as rickm@localhost, which is not
> helpful even when they are justified.
>
> I'm afraid I'm not familiar with your setup so wouldn't know how to
> configure that.

The mailq command shows many of the following:

16m  2.6K 1qks1r-005B1x-2l <>
           6626-879-8427-40-rickm=timshel.ca@mail.purecuresol.co

15m  3.1K 1qks2o-005BHh-0S <>
           bounce+c764ac.103fa-rickm=timshel.ca@inputhealth.com

15m  2.6K 1qks2o-005BI0-2K <>
           6595-611-17423-903-rickm=timshel.ca@mail.turntext.co

15m  2.7K 1qks2p-005BIG-0u <>
           6613-452-119912-590-rickm=timshel.ca@mail.ikariacool.co

15m  2.6K 1qks2p-005BIL-2m <>
           6626-879-8427-40-rickm=timshel.ca@mail.purecuresol.co
...etc...
  2m  2.7K 1qksFP-005Hqj-0e <> *** frozen ***
           6613-452-119912-590-rickm=timshel.ca@mail.ikariacool.co

  2m  2.6K 1qksFP-005Hqs-2U <> *** frozen ***
           6626-879-8427-40-rickm=timshel.ca@mail.purecuresol.co

  1m  3.1K 1qksGL-005IAq-2A <> *** frozen ***
           bounce+c764ac.103fa-rickm=timshel.ca@inputhealth.com

  1m  2.6K 1qksGM-005IBF-0n <> *** frozen ***
           6595-611-17423-903-rickm=timshel.ca@mail.turntext.co

  1m  2.7K 1qksGM-005IBh-2h <> *** frozen ***
           6613-452-119912-590-rickm=timshel.ca@mail.ikariacool.co

  1m  2.6K 1qksGN-005IBo-1O <> *** frozen ***
           6626-879-8427-40-rickm=timshel.ca@mail.purecuresol.co

I wasn't going to ask about this, but it's looking like this is related 
to the problem...

I've been getting hundreds or thousands of "MAIL FROZEN" messages. I 
eventually added a procmail rule to send the to /dev/null instead of the 
TRASH folder. I guess I should try to understand and fix these as well.

Just now I changed /dev/null to a folder. I see over 20 per minute at 
times! Here's the text of one:

Message 1qknJa-004Nen-0O has been frozen (delivery error message).
The sender is <>.
The following address(es) have yet to be delivered:

   6595-611-17423-903-rickm=timshel.ca@mail.turntext.co: SMTP error from remote mail server after MAIL FROM:<> SIZE=3757: 550 <> sender rejected. AUP#CDRBL





>> I should explain that my domain and email address are hosted at Dreamhost. I
>> use fetchmail to pull it from there to the IMAP server that I run on my
>> Linux machine. So I think that means these reply attempts occur when
>> fetchmail passes mail to my local machine. I've been adding more and more
>> rules to my procmail filtering, but I don't know if these reply attempts are
>> before or after procmail processes my rules.
> These appear to be because fetchmail attempted to deliver messages
> to you that were syntactically invalid, so your Exim rejected them
> and generated a bounce message to the sender to be helpful. You
> never saw the messages and procmail was not involved as Exim did not
> get as far as doing a delivery attempt.

If this is happening before the delivery is attempted, then my question 
to Michael about Thunderbird's Return Receipts can't be part of the problem.

Some of the mail in the queue is up to 4 days old. I'm going to clear it 
all out to see what new arrives in this state.

Rick

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Are people trying to relay mail through my system? Rick Macdonald <rickmacd@shaw.ca> - 2023-09-25 05:00 +0200
  Re: Are people trying to relay mail through my system? Michael Kjörling <2695bd53d63c@ewoof.net> - 2023-09-25 16:40 +0200
    Re: Are people trying to relay mail through my system? Rick Macdonald <rickmacd@shaw.ca> - 2023-09-25 20:40 +0200
  Re: Are people trying to relay mail through my system? Andy Smith <andy@strugglers.net> - 2023-09-25 18:10 +0200
    Re: Are people trying to relay mail through my system? Rick Macdonald <rickmacd@shaw.ca> - 2023-09-25 20:30 +0200
      Re: Are people trying to relay mail through my system? Michael Kjörling <2695bd53d63c@ewoof.net> - 2023-09-25 20:50 +0200
        Re: Are people trying to relay mail through my system? Rick Macdonald <rickmacd@shaw.ca> - 2023-09-25 22:40 +0200
      Re: Are people trying to relay mail through my system? Andy Smith <andy@strugglers.net> - 2023-09-25 22:30 +0200
      Re: Are people trying to relay mail through my system? Andy Smith <andy@strugglers.net> - 2023-09-25 22:30 +0200
        Re: Are people trying to relay mail through my system? Rick Macdonald <rickmacd@shaw.ca> - 2023-09-25 23:00 +0200
          Re: Are people trying to relay mail through my system? Rick Macdonald <rickmacd@shaw.ca> - 2023-09-26 01:00 +0200
            Re: Are people trying to relay mail through my system? Greg Wooledge <greg@wooledge.org> - 2023-09-26 01:20 +0200
              Re: Are people trying to relay mail through my system? Rick Macdonald <rickmacd@shaw.ca> - 2023-09-26 03:50 +0200
              Re: Are people trying to relay mail through my system? Curt <curty@free.fr> - 2023-09-26 16:40 +0200

csiph-web