1

Topic: Sender with from=<>

==== Required information ====
- iRedMail version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Linux/BSD distribution name and version:
- Related log if you're reporting an issue:
====

Hi...

My server is sending spam and the sender is empty.. (from=<>).

Example:

Nov 26 23:42:38 mail postfix/qmgr[9059]: 9A7BD2A2917: from=<>, size=5659, nrcpt=1 (queue active)
Nov 26 23:42:39 mail postfix/smtp[9979]: connect to mailserver.innvento2.org[190.95.213.11]:25: Connection refused
Nov 26 23:42:39 mail postfix/smtp[9979]: 9A7BD2A2917: to=<noresponder@innvento2.org>, relay=none, delay=13035, delays=13035/0.01/0.31/0, dsn=4.4.1, status=deferred (connect to mailserver.innvento2.org[190.95.213.11]:25: Connection refused)



the remote server refused me but i would want to know how to can i block this mails.


Thank you.!!!!

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Sender with from=<>

*) Please show us output of command "postconf -n" here to help troubleshoot.
*) Please paste FULL smtp session log in Postfix log file, not just the lines you think it's enough for troubleshooting.

3 (edited by jlcmux 2014-11-29 08:49:38)

Re: Sender with from=<>

postconf -n

alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
allow_min_user = no
allow_percent_hack = no
append_dot_mydomain = no
biff = no
bounce_queue_lifetime = 4h
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
delay_warning_time = 0h
disable_vrfy_command = yes
dovecot_destination_recipient_limit = 1
enable_original_recipient = no
home_mailbox = Maildir/
inet_interfaces = all
inet_protocols = ipv4
mailbox_command = /usr/lib/dovecot/deliver
mailbox_size_limit = 0
maximal_backoff_time = 4000s
maximal_queue_lifetime = 4h
message_size_limit = 25728640
minimal_backoff_time = 300s
mydestination = $myhostname, localhost, localhost.localdomain, localhost.$myhostname
mydomain = uniroca.com
myhostname = mail.uniroca.com
mynetworks = 127.0.0.0/8
mynetworks_style = host
myorigin = uniroca.com
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions
queue_run_delay = 300s
readme_directory = no
recipient_bcc_maps = proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_user.cf, proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_domain.cf
recipient_delimiter = +
relay_domains = $mydestination, proxy:mysql:/etc/postfix/mysql/relay_domains.cf
relayhost =
sender_bcc_maps = proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_user.cf, proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_domain.cf
smtp-amavis_destination_recipient_limit = 1
smtp_data_init_timeout = 240s
smtp_data_xfer_timeout = 600s
smtp_tls_CAfile = $smtpd_tls_CAfile
smtp_tls_loglevel = 0
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:10031
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_helo_access pcre:/etc/postfix/helo_access.pcre
smtpd_recipient_restrictions = reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, check_policy_service inet:127.0.0.1:10031, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_rbl_client ix.dnsbl.manitu.net, reject_rbl_client zen.spamhaus.org, reject_rbl_client dnsbl.sorbs.net, reject_rbl_client bl.spamcop.net, permit
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination,
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql/sender_login_maps.cf
smtpd_sender_restrictions = permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated, check_client_access cidr:/etc/postfix/internal_clients_filter, reject_unknown_address, reject_unknown_sender_domain, reject_non_fqdn_sender
smtpd_tls_CAfile = /etc/ssl/certs/iRedMail_CA.pem
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/ssl/certs/iRedMail_CA.pem
smtpd_tls_key_file = /etc/ssl/private/iRedMail.key
smtpd_tls_loglevel = 0
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
swap_bangpath = no
tls_random_source = dev:/dev/urandom
transport_maps = proxy:mysql:/etc/postfix/mysql/transport_maps_user.cf, proxy:mysql:/etc/postfix/mysql/transport_maps_domain.cf
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql/virtual_alias_maps.cf, proxy:mysql:/etc/postfix/mysql/domain_alias_maps.cf, proxy:mysql:/etc/postfix/mysql/catchall_maps.cf, proxy:mysql:/etc/postfix/mysql/domain_alias_catchall_maps.cf
virtual_gid_maps = static:2000
virtual_mailbox_base = /var/mail
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_maps.cf
virtual_minimum_uid = 2000
virtual_transport = dovecot
virtual_uid_maps = static:2000



The Log. 

Nov 28 19:37:20 mail postfix/qmgr[9059]: 7C7A32A1E16: removed
Nov 28 19:37:21 mail postfix/pipe[29374]: E0C782A1E83: to=<emesa@uniroca.com>, relay=dovecot, delay=0.15, delays=0.03/0/0/0.12, dsn=2.0.0, status=sent (delivered via dovecot service)
Nov 28 19:37:21 mail postfix/qmgr[9059]: E0C782A1E83: removed
Nov 28 19:38:14 mail postfix/anvil[29042]: statistics: max connection rate 1/60s for (smtp:190.216.158.73) at Nov 28 19:29:59
Nov 28 19:38:14 mail postfix/anvil[29042]: statistics: max connection count 1 for (smtp:190.216.158.73) at Nov 28 19:29:59
Nov 28 19:38:14 mail postfix/anvil[29042]: statistics: max cache size 2 at Nov 28 19:30:13
Nov 28 19:39:01 mail CRON[29457]: (root) CMD (  [ -x /usr/lib/php5/maxlifetime ] && [ -x /usr/lib/php5/sessionclean ] && [ -d /var/lib/php5 ] && /usr/lib/php5/sessionclean /var/lib/php5 $(/usr/lib/php5/maxlifetime))
Nov 28 19:40:02 mail CRON[29469]: (www-data) CMD ([ -x /usr/share/awstats/tools/update.sh ] && /usr/share/awstats/tools/update.sh)
Nov 28 19:42:45 mail postfix/qmgr[9059]: 254932A1731: from=<>, size=4708, nrcpt=1 (queue active)
Nov 28 19:42:45 mail postfix/smtp[29488]: connect to mailserver.innvento2.org[190.95.213.11]:25: Connection refused
Nov 28 19:42:45 mail postfix/smtp[29488]: 254932A1731: to=<noresponder@innvento2.org>, relay=none, delay=2184, delays=2184/0.02/0.31/0, dsn=4.4.1, status=deferred (connect to mailserver.innvento2.org[190.95.213.11]:25: Connection refused)



i cant see de logging for this email.


Thank you.!

4

Re: Sender with from=<>

Postfix config looks fine. but the log you pasted is not a full smtp session.

A full smtp session log starts with 'connect from [xx.xx.xx.xx]', and ends with 'disconnect from [xx.xx.xx.xx]'.

5

Re: Sender with from=<>

ZhangHuangbin wrote:

Postfix config looks fine. but the log you pasted is not a full smtp session.

A full smtp session log starts with 'connect from [xx.xx.xx.xx]', and ends with 'disconnect from [xx.xx.xx.xx]'.


sometimes is an  delivery status notification that my server send to my clients.  (mail refused.. etc)..

Nov 28 07:17:29 mail postfix/qmgr[9059]: CDBE72A2B09: from=<>, size=3823, nrcpt=1 (queue active)
Nov 28 07:17:29 mail postfix/bounce[28294]: 4867D2A2A5D: sender delivery status notification: CDBE72A2B09


But sometimes this from=<>  sends emails to external servers.. but obviously is refused.


i think this from=<>  is my   delivery  notification  but why sends emails with from empty?


Thank you

6

Re: Sender with from=<>

jlcmux wrote:

i think this from=<>  is my   delivery  notification  but why sends emails with from empty?

Empty sender (from=<>) is called "null sender", it's legal and defined in RFC document, MTA (Postfix, etc) uses it to send non-delivery notification, bounce messages, etc.

Why i ask full smtp session log is trying to figure out whether it was forged by some local user. If you can make sure it's due to mail forwarding by your user, then it's ok.

7

Re: Sender with from=<>

ZhangHuangbin wrote:
jlcmux wrote:

i think this from=<>  is my   delivery  notification  but why sends emails with from empty?

Empty sender (from=<>) is called "null sender", it's legal and defined in RFC document, MTA (Postfix, etc) uses it to send non-delivery notification, bounce messages, etc.

Why i ask full smtp session log is trying to figure out whether it was forged by some local user. If you can make sure it's due to mail forwarding by your user, then it's ok.


i think that because always that from=<> sends one email, i never see one logging for that email request, neither one disconnect.

it's ok then?

thank you.!

8

Re: Sender with from=<>

jlcmux wrote:

it's ok then?

I suggest you check whether or not it's sending spam. If not spam, it's ok.

9

Re: Sender with from=<>

ZhangHuangbin wrote:
jlcmux wrote:

it's ok then?

I suggest you check whether or not it's sending spam. If not spam, it's ok.


For example.

Nov 28 14:02:02 mail postfix/smtp[17668]: 509D72A18F3: to=<Luz.Villada@epm.com.co>, relay=epm-com-co.mail.protec$
Nov 28 14:02:02 mail postfix/qmgr[9059]: 509D72A18F3: removed
Nov 28 14:02:11 mail postfix/smtpd[17569]: connect from unknown[192.168.45.2]
Nov 28 14:02:15 mail postfix/smtpd[17569]: D41532A1205: client=unknown[192.168.45.2], sasl_method=LOGIN, sasl_us$
Nov 28 14:02:16 mail postfix/cleanup[17432]: D41532A1205: message-id=<009a01d00b3d$96ee13c0$c4ca3b40$@uniroca.co$
Nov 28 14:02:16 mail postfix/qmgr[9059]: D41532A1205: from=<lcastrillon@uniroca.com>, size=3172, nrcpt=1 (queue $
Nov 28 14:02:19 mail postfix/smtpd[17637]: connect from mail.uniroca.com[127.0.0.1]
Nov 28 14:02:19 mail postfix/smtpd[17637]: 0FBF52A18F3: client=mail.uniroca.com[127.0.0.1]
Nov 28 14:02:19 mail postfix/cleanup[17496]: 0FBF52A18F3: message-id=<009a01d00b3d$96ee13c0$c4ca3b40$@uniroca.co$
Nov 28 14:02:19 mail postfix/qmgr[9059]: 0FBF52A18F3: from=<lcastrillon@uniroca.com>, size=4170, nrcpt=1 (queue $
Nov 28 14:02:19 mail postfix/smtpd[17637]: disconnect from mail.uniroca.com[127.0.0.1]
Nov 28 14:02:19 mail amavis[12230]: (12230-19) Passed CLEAN {RelayedInternal}, MYNETS/MYUSERS LOCAL [192.168.45.$
Nov 28 14:02:19 mail postfix/smtp[17630]: D41532A1205: to=<Luz.Villada@epm.com.co>, relay=127.0.0.1[127.0.0.1]:1$
Nov 28 14:02:19 mail postfix/qmgr[9059]: D41532A1205: removed
Nov 28 14:02:19 mail postfix/smtpd[17569]: disconnect from unknown[192.168.45.2]
Nov 28 14:02:23 mail postfix/smtp[17668]: 0FBF52A18F3: to=<Luz.Villada@epm.com.co>, relay=epm-com-co.mail.protec$
Nov 28 14:02:23 mail postfix/qmgr[9059]: 0FBF52A18F3: removed
Nov 28 14:02:45 mail postfix/qmgr[9059]: 4EB2D2A188A: from=<>, size=4835, nrcpt=1 (queue active)
Nov 28 14:02:49 mail postfix/smtpd[17697]: connect from outsrvco12.carvajal.com[190.242.22.12]
Nov 28 14:02:50 mail postfix/smtpd[17697]: A4F7C2A1205: client=outsrvco12.carvajal.com[190.242.22.12]
Nov 28 14:02:50 mail postfix/cleanup[17638]: A4F7C2A1205: message-id=<ADR3900000009228550012C521F6DB691EE49DE626$
Nov 28 14:02:51 mail postfix/qmgr[9059]: A4F7C2A1205: from=<fp6124@propal.com.co>, size=46877, nrcpt=1 (queue ac$
Nov 28 14:02:51 mail postfix/smtpd[17697]: disconnect from outsrvco12.carvajal.com[190.242.22.12]
Nov 28 14:02:52 mail postfix/smtpd[17439]: connect from mail.uniroca.com[127.0.0.1]
Nov 28 14:02:52 mail postfix/smtpd[17439]: 186372A18F3: client=mail.uniroca.com[127.0.0.1]
Nov 28 14:02:52 mail postfix/cleanup[17639]: 186372A18F3: message-id=<ADR3900000009228550012C521F6DB691EE49DE626$
Nov 28 14:02:52 mail postfix/qmgr[9059]: 186372A18F3: from=<fp6124@propal.com.co>, size=47284, nrcpt=1 (queue ac$
Nov 28 14:02:52 mail postfix/smtpd[17439]: disconnect from mail.uniroca.com[127.0.0.1]
Nov 28 14:02:52 mail amavis[13960]: (13960-09) Passed CLEAN {RelayedInternal}, MYUSERS LOCAL [190.242.22.12]:430$
Nov 28 14:02:52 mail postfix/smtp[17437]: A4F7C2A1205: to=<asesorcali3@uniroca.com>, relay=127.0.0.1[127.0.0.1]:$
Nov 28 14:02:52 mail postfix/qmgr[9059]: A4F7C2A1205: removed
Nov 28 14:02:52 mail postfix/pipe[17641]: 186372A18F3: to=<asesorcali3@uniroca.com>, relay=dovecot, delay=0.28, $
Nov 28 14:02:52 mail postfix/qmgr[9059]: 186372A18F3: removed
Nov 28 14:02:59 mail postfix/smtpd[17569]: connect from unknown[192.168.45.2]
Nov 28 14:02:59 mail postfix/smtpd[17569]: E17A52A1205: client=unknown[192.168.45.2], sasl_method=LOGIN, sasl_us$




other.. (refused)




Nov 28 15:22:42 mail postfix/pipe[21286]: B2AC72A1919: to=<mieusse@uniroca.com>, relay=dovecot, delay=0.23, dela$
Nov 28 15:22:42 mail postfix/qmgr[9059]: B2AC72A1919: removed
Nov 28 15:22:43 mail postfix/smtpd[21413]: 172782A11F9: client=blu004-omc2s22.hotmail.com[65.55.111.97]
Nov 28 15:22:43 mail postfix/cleanup[21118]: 172782A11F9: message-id=<BLU436-SMTP106E12879FCEA0A8F66C48CCC7E0@ph$
Nov 28 15:22:44 mail postfix/qmgr[9059]: 172782A11F9: from=<gerencia@alphashoesgroup.com>, size=30526, nrcpt=1 ($
Nov 28 15:22:44 mail postfix/smtpd[21156]: connect from mail.uniroca.com[127.0.0.1]
Nov 28 15:22:44 mail postfix/smtpd[21156]: CF94C2A1205: client=mail.uniroca.com[127.0.0.1]
Nov 28 15:22:44 mail postfix/cleanup[21157]: CF94C2A1205: message-id=<BLU436-SMTP106E12879FCEA0A8F66C48CCC7E0@ph$
Nov 28 15:22:44 mail postfix/qmgr[9059]: CF94C2A1205: from=<gerencia@alphashoesgroup.com>, size=30923, nrcpt=1 ($
Nov 28 15:22:44 mail postfix/smtpd[21156]: disconnect from mail.uniroca.com[127.0.0.1]
Nov 28 15:22:44 mail amavis[20444]: (20444-07) Passed CLEAN {RelayedInternal}, MYUSERS LOCAL [65.55.111.97]:4994$
Nov 28 15:22:44 mail postfix/smtpd[21413]: disconnect from blu004-omc2s22.hotmail.com[65.55.111.97]
Nov 28 15:22:44 mail postfix/smtp[21583]: 172782A11F9: to=<dsuarez@uniroca.com>, relay=127.0.0.1[127.0.0.1]:1002$
Nov 28 15:22:44 mail postfix/qmgr[9059]: 172782A11F9: removed
Nov 28 15:22:45 mail postfix/pipe[21587]: CF94C2A1205: to=<dsuarez@uniroca.com>, relay=dovecot, delay=0.2, delay$
Nov 28 15:22:45 mail postfix/qmgr[9059]: CF94C2A1205: removed
Nov 28 15:22:45 mail postfix/qmgr[9059]: 4B9752A18C5: from=<secreventas@uniroca.com>, size=6149379, nrcpt=1 (que$
Nov 28 15:22:45 mail postfix/qmgr[9059]: 9C6E32A18CB: from=<>, size=4724, nrcpt=1 (queue active)
Nov 28 15:22:45 mail postfix/smtp[21616]: connect to mailserver.innvento2.org[190.95.213.11]:25: Connection refu$
Nov 28 15:22:45 mail postfix/smtp[21616]: 9C6E32A18CB: to=<noresponder@innvento2.org>, relay=none, delay=13135, $
Nov 28 15:22:45 mail postfix/smtp[21615]: connect to mx12.marsh.com[205.156.137.72]:25: Connection refused
Nov 28 15:22:47 mail postfix/smtpd[21237]: disconnect from mailgate01.mmm.com[136.229.2.23]
Nov 28 15:22:53 mail postfix/smtp[21615]: 4B9752A18C5: to=<nelcy.t.sanchez@marsh.com>, relay=mx11.marsh.com[205.$
Nov 28 15:22:54 mail postfix/qmgr[9059]: 4B9752A18C5: removed
Nov 28 15:23:32 mail postfix/smtpd[21413]: connect from a100.161.betara.net[209.126.100.161]
Nov 28 15:23:33 mail postfix/smtpd[21413]: 8B66F2A11F9: client=a100.161.betara.net[209.126.100.161]
Nov 28 15:23:33 mail postfix/cleanup[21118]: 8B66F2A11F9: message-id=<B6B305565D898EFD21246DDA5E84907B@localhost$
Nov 28 15:23:35 mail postfix/qmgr[9059]: 8B66F2A11F9: from=<no-responder@betara.net>, size=25825, nrcpt=1 (queue$
Nov 28 15:23:35 mail postfix/smtpd[21413]: disconnect from a100.161.betara.net[209.126.100.161]
Nov 28 15:23:39 mail postfix/smtpd[21598]: connect from mail.uniroca.com[127.0.0.1]
Nov 28 15:23:39 mail postfix/smtpd[21598]: 323982A1919: client=mail.uniroca.com[127.0.0.1]
Nov 28 15:23:39 mail postfix/cleanup[21157]: 323982A1919: message-id=<B6B305565D898EFD21246DDA5E84907B@localhost$
Nov 28 15:23:39 mail postfix/qmgr[9059]: 323982A1919: from=<no-responder@betara.net>, size=26510, nrcpt=1 (queue$
Nov 28 15:23:39 mail postfix/smtpd[21598]: disconnect from mail.uniroca.com[127.0.0.1]
Nov 28 15:23:39 mail amavis[21526]: (21526-01) Passed CLEAN {RelayedInternal}, MYUSERS LOCAL [209.126.100.161]:3$



is bad?

10

Re: Sender with from=<>

Any log in /var/log/iredapd.log related to null sender?

11

Re: Sender with from=<>

ZhangHuangbin wrote:

Any log in /var/log/iredapd.log related to null sender?


admail@mail:~$ sudo tail -f /var/log/iredapd.log
[sudo] password for admail:
2014-11-29 17:40:22 INFO [200.32.56.16] AndresArturo.Rojas@cencosud.com.co -> lmorris@uniroca.com, DUNNO
2014-11-29 17:40:24 INFO [200.32.56.16] AndresArturo.Rojas@cencosud.com.co -> asesorbogota2@uniroca.com, DUNNO
2014-11-29 17:41:14 INFO [199.16.156.161] b0403173bc5comercioexterior=uniroca.com@bounce.twitter.com -> comercioexterior@uniroca.com, DUNNO
2014-11-29 18:01:27 INFO [54.247.120.131] realityprojects@net-c.com -> uniroca@uniroca.com, DUNNO
2014-11-29 18:12:25 INFO [87.106.20.205] habres.net@s15217998.onlinehome-server.info -> dsuarez@uniroca.com, DUNNO
2014-11-29 18:15:16 INFO [200.32.56.16] AndresArturo.Rojas@cencosud.com.co -> asistenteventas3@uniroca.com, DUNNO
2014-11-29 18:15:18 INFO [200.32.56.16] AndresArturo.Rojas@cencosud.com.co -> asesorbogota2@uniroca.com, DUNNO
2014-11-29 18:16:00 INFO [198.58.124.214] castete@seminariosytalleresenperu.com -> cpinzon@uniroca.com, DUNNO
2014-11-29 18:18:39 INFO [200.32.56.17] AndresArturo.Rojas@cencosud.com.co -> asistenteventas3@uniroca.com, DUNNO
2014-11-29 18:18:41 INFO [200.32.56.17] AndresArturo.Rojas@cencosud.com.co -> asesorbogota2@uniroca.com, DUNNO



Other.


root@mail:/var/log# tail -f /var/log/iredapd.log.1
2014-11-24 06:14:07 INFO [94.79.245.196] inhales@fbclouderfb.com -> mantenimiento@uniroca.com, DUNNO
2014-11-24 06:16:41 INFO [93.74.62.170] torpedoesok@fbclouderfb.com -> lvillada@uniroca.com, DUNNO
2014-11-24 06:16:54 INFO [219.92.18.209] reclinersklz7681@fbclouderfb.com -> recepcion@uniroca.com, DUNNO
2014-11-24 06:18:27 INFO [200.9.128.203] MB_LATIQUETERA.0.278.55558@rebotes03.masterbase.com -> comprascal@uniroca.com, DUNNO
2014-11-24 06:22:58 INFO [173.44.63.237] anunciox001@gmail.com -> uniroca@uniroca.com, DUNNO
2014-11-24 06:24:15 INFO [216.82.243.196] Valentin.TORO@sodexo.com -> asistenteventas1@uniroca.com, DUNNO
2014-11-24 06:24:16 INFO [216.82.243.196] Valentin.TORO@sodexo.com -> facturacion@uniroca.com, DUNNO
2014-11-24 06:25:58 INFO [74.116.233.15] newsletter@elabs10.com -> jroldan@uniroca.com, DUNNO
2014-11-24 06:27:25 INFO [50.7.11.19] abm_50_26_546be1f3db6196d65201405d@m.campanhaemail.com.br -> cpinzon@uniroca.com, DUNNO
2014-11-24 06:27:52 INFO [74.116.233.15] newsletter@elabs10.com -> mruiz@uniroca.com, DUNNO


Other.

2014-11-16 05:36:13 INFO [206.72.198.30] rebotes@marketineros13.com -> atobon@uniroca.com, DUNNO
2014-11-16 05:50:23 INFO [190.144.240.123] telemensajes@telesentinel.net -> asistenterh@uniroca.com, DUNNO
2014-11-16 05:50:28 INFO [190.144.240.123] telemensajes@telesentinel.net -> diradmon@uniroca.com, DUNNO
2014-11-16 05:50:34 INFO [190.144.240.123] telemensajes@telesentinel.net -> lvillada@uniroca.com, DUNNO
2014-11-16 06:21:35 INFO [200.9.128.225] MB_LATIQUETERA.0.265.56636@sender25.masterbase.com -> sistemas@uniroca.com, DUNNO
2014-11-16 06:22:17 INFO [200.9.128.210] MB_LATIQUETERA.0.265.69734@rebotes10.masterbase.com -> uniroca@uniroca.com, DUNNO
2014-11-16 06:36:23 INFO [208.117.48.79] bounces+143002-c947-lvillada=uniroca.com@email.cuponatic.com.co -> lvillada@uniroca.com, DUNNO
2014-11-16 06:43:22 INFO [190.144.240.125] telemensajes@telesentinel.net -> asistenterh@uniroca.com, DUNNO
2014-11-16 06:43:23 INFO [190.144.240.125] telemensajes@telesentinel.net -> diradmon@uniroca.com, DUNNO
2014-11-16 06:43:26 INFO [190.144.240.125] telemensajes@telesentinel.net -> lvillada@uniroca.com, DUNNO



Thank you.!

12

Re: Sender with from=<>

The null sender in syslog are many than the logs in iredapd.log...

13

Re: Sender with from=<>

Pasted iRedAPD log doesn't contains null sender. I suggest you check this tutorial:
http://www.postfix.org/BACKSCATTER_README.html