1 Topic by ecerichter

  • ecerichter
  • Member
  • Offline
  • Registered: 2020-01-08
  • Posts: 3

Topic: Receiving spam from my own address

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 0.9.9 PGSQL edition
- Deployed with iRedMail Easy or the downloadable installer? downloadable installer
- Linux/BSD distribution name and version: CentOS Linux release 7.7.1908 (Core)
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): PGSQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? no
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

I don't know how, but I'm currently receiving spam from my own address - but from different servers. How would I stop it?

Follow mail headers:

From - Wed Jan  8 09:15:53 2020
X-Account-Key: account3
X-UIDL: 0000b8bc5d8abd99
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:                                                                                 
Return-Path: <www-data@server3.assessoriajud.com>
Delivered-To: myusername@myowndomain.com.br
Received: from mail.myowndomain.com.br (mail.myowndomain.com.br [127.0.0.1])
    by mail.myowndomain.com.br (Postfix) with ESMTP id 47t48M21g2z57XPh
    for <myusername@myowndomain.com.br>; Wed,  8 Jan 2020 06:44:19 -0300 (-03)
X-Amavis-Modified: Mail body modified (defanged) - mail.myowndomain.com.br
X-Virus-Scanned: amavisd-new at mail.myowndomain.com.br
X-Amavis-Alert: BAD HEADER SECTION, Improper use of control character (char 0D
    hex): From:  <myusername@myowndomain.com.br>
X-Spam-Flag: NO
X-Spam-Score: 4.318
X-Spam-Level: ****
X-Spam-Status: No, score=4.318 tagged_above=2 required=6.2
    tests=[FROM_ADDR_WS=0.763, FROM_WSP_TRAIL=1,
    HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001,
    HTML_MIME_NO_HTML_TAG=0.635, MIME_HTML_ONLY=0.1, SPF_HELO_NONE=0.001,
    SPF_NONE=0.001, SUBJECT_NEEDS_ENCODING=0.1, SUBJ_ILLEGAL_CHARS=1.105,
    TO_EQ_FM_HTML_ONLY=0.362] autolearn=no autolearn_force=no
Received: from mail.myowndomain.com.br ([127.0.0.1])
    by mail.myowndomain.com.br (mail.myowndomain.com.br [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id UxddO3Dvleaw for <myusername@myowndomain.com.br>;
    Wed,  8 Jan 2020 06:44:18 -0300 (-03)
Received: from server3.assessoriajud.com (server3.assessoriajud.com [116.202.96.153])
    by mail.myowndomain.com.br (Postfix) with ESMTP id 47t48L0ndgz57dlw
    for <myusername@myowndomain.com.br>; Wed,  8 Jan 2020 06:44:18 -0300 (-03)
Received: by server3.assessoriajud.com (Postfix, from userid 33)
    id 84B414DCE0; Wed,  8 Jan 2020 10:15:20 +0100 (CET)
To: myusername@myowndomain.com.br

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Receiving spam from my own address

ecerichter wrote:

X-Spam-Status: No, score=4.318 tagged_above=2 required=6.2
    tests=[FROM_ADDR_WS=0.763, FROM_WSP_TRAIL=1,
    HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001,
    HTML_MIME_NO_HTML_TAG=0.635, MIME_HTML_ONLY=0.1, SPF_HELO_NONE=0.001,
    SPF_NONE=0.001, SUBJECT_NEEDS_ENCODING=0.1, SUBJ_ILLEGAL_CHARS=1.105,
    TO_EQ_FM_HTML_ONLY=0.362] autolearn=no autolearn_force=no

If you pay attention to this header line, you can find that SpamAssassin already detects the possible spams, but the spam score of matched rules are not well tuned and use default scores.

Try to add these lines in /etc/mail/spamassassin/local.cf, then restart amavisd service to load new settings. It should catch these spams.

# To == From and direct-to-MX
score TO_EQ_FM_DIRECT_MX 5
# To domain == From domain and HTML image link
score TO_EQ_FM_DOM_HTML_IMG 5
# To domain == From domain and HTML only    0.001
score TO_EQ_FM_DOM_HTML_ONLY 5
# To domain == From domain and external SPF failed    0.001
score TO_EQ_FM_DOM_SPF_FAIL 5
# To == From and HTML only    0.001
score TO_EQ_FM_HTML_ONLY 5
# To == From and external SPF failed
score TO_EQ_FM_SPF_FAIL 5

# Malformed From address
score FROM_ADDR_WS 5

# From: has too many raw illegal characters
score SUBJ_ILLEGAL_CHARS 5