Mail with FROM and TO not managed by server (en/de)

dia_moos

Hi,

Hi,
i see suspicious behavior in rspamd. Mail FROM and TO are apparently passed through, whose domains my server does not manage. Mailcow is behind a NAT.

Does this just look like it’s not going to be rejected? Or did I forget a setting?

German:

Hallo,
ich sehe in rspamd ein verdächtiges Verhalten. Mail FROM und TO werden scheinbar durchgeleitet, deren Domains mein Server nicht verwaltet. Der Dienst läuft hinter einem NAT, ich kann also wohl nicht die IP checken.

Sieht das nur so aus als würde es nicht zurückgewiesen? Oder habe ich eine Einstellung vergessen?

Dan

dia_moos Mailcow is behind a NAT.

Please double check that your Mailcow is not an open relay. For example, using this tool: https://mxtoolbox.com/diagnostic.aspx

NAT rewrites the source IP address, so if your mail server is behind a NAT, the source IP will be a local IP address. Mailcow by default allows relaying from local networks, so this configuration can result in an open relay. See https://mailcow.github.io/mailcow-dockerized-docs/firststeps-rfc-1918/ for instructions on how to change this.

dia_moos

Like this:

Postfix-Log:
22.03.2021, 19:34:08 info B7C1B60866: to=<on****03@yahoo.com>, relay=mta7.am0.yahoodns.net[67.195.204.73]:25, delay=2.2, delays=0.19/0.2/0.96/0.9, dsn=5.7.9, status=bounced (host mta7.am0.yahoodns.net[67.195.204.73] said: 554 5.7.9 Message not accepted for policy reasons. See https://postmaster.verizonmedia.com/error-codes (in reply to end of DATA command))
22.03.2021, 19:34:06 info Trusted TLS connection established to mta7.am0.yahoodns.net[67.195.204.73]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
22.03.2021, 19:34:05 info E7EDB607DC: to=<on****03@yahoo.com>, relay=mta6.am0.yahoodns.net[67.195.228.111]:25, delay=8.2, delays=1/0.02/6.4/0.74, dsn=5.7.9, status=bounced (host mta6.am0.yahoodns.net[67.195.228.111] said: 554 5.7.9 Message not accepted for policy reasons. See https://postmaster.verizonmedia.com/error-codes (in reply to end of DATA command))
22.03.2021, 19:34:04 info Trusted TLS connection established to mta6.am0.yahoodns.net[67.195.228.111]:25: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
22.03.2021, 19:33:57 info E7EDB607DC: from=<on****03@yahoo.com>, size=1027, nrcpt=1 (queue active)
22.03.2021, 19:33:57 info E7EDB607DC: message-id=dace14af833895d7711986203d7f1639@yahoo.com

Rspamd:
dace14af833895d7711986203d7f1639@yahoo.com 10.0.3.2 on****03@yahoo.com on****03@yahoo.com Valid SMTP 116.202.*.*

dia_moos

Dan Yes, that seems to fix the problem. thx

Dan

dia_moos Note that not having the right source IP will cause some issues:

Some spam blocklists will be useless, as they’re based on the sender IP, so you may get more spam.
Bruteforce protection (fail2ban) won’t work properly, as all connections will have the same source IP

If possible, I’d recommend directly connecting your mailserver to the internet rather than using NAT.

dia_moos

Dan ‘directly connecting your mailserver to the internet’

That’s my fix… thx