Hello, My Mailcow server is blacklisted. I discover that the server sent mails from it@. This email doesn't exist. How to stop it please ?

@"Kan"#p14078 don't you see the IP those are coming from?

@"DocFraggle"#1599 : the email address it@.... does not exist on the server and the mail server is not open (tested with mxtoolbox) @"maddler"#12116 : For all these mails IP logged was docker ip (172.22....) Due to log rotation I can't see these informations with "docker compose logs postfix-mailcow". How can I access to older logs ?

Spams from it@mailcow

Kan

Hello,

My Mailcow server is blacklisted. I discover that the server sent mails from it@<mailcow.hostname>. This email doesn’t exist. How to stop it please ?

maddler

You might want to have a look at your postfix logs and see where those messages are originating from.

Kan

All that I found is tons of mails from it@<mailcow.hostname>. I don’t know how to find how they were generated. All accounts passwords are strong (mailcow auto-generated). I suspect a security breach in SoGo so I turned it off as customers don’t use it.

DocFraggle

Kan do you have an actual mailbox or valid alias named it@<mailcow.hostname>? If not, then Sogo won’t send mails from an unknown email address. Did you check if you accidentally act as an open relay?

https://mxtoolbox.com/SuperTool.aspx?action=smtp%3Afqdn.of.your.mail.server&run=toolpage

maddler

Kan don’t you see the IP those are coming from?

Kan

@DocFraggle : the email address it@…. does not exist on the server and the mail server is not open (tested with mxtoolbox)

@maddler : For all these mails IP logged was docker ip (172.22….)

Due to log rotation I can’t see these informations with “docker compose logs postfix-mailcow”. How can I access to older logs ?

maddler

Maybe keep an eye for the next one and see if you can find the whole flow?