1

Topic: Spam FROM LOCAL [127.0.0.1]:36396 - postmaster

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.3.2
- Deployed with iRedMail Easy or the downloadable installer?
- Linux/BSD distribution name and version: ubuntu 18.04
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):  Mysql
- Web server (Apache or Nginx): nginx
- Manage mail accounts with iRedAdmin-Pro? no
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

When sending email I am getting message from postmaster@mydomain.com "Spam FROM LOCAL [127.0.0.1]:36396"

Spam scanner report:
Spam detection software, running on the system "mydomain.com",
has identified this incoming email as possible spam.

From /var/log/maillog - there is no error and the message status =sent

Any help is much appreciated.

Thanks,
Jung

====Message from postmaster@mydomain.com=====

Spam FROM LOCAL [127.0.0.1]:36396 <email@mydomain.com>
Contact photo
From Content-filter at mydomain.com <postmaster@mydomain.com> on 2022-03-14 16:52
Details
header.hdr
(~3 KB)
Content type: Spam
Internal reference code for the message is 61239-01/toho968QB75q

First upstream SMTP client IP address: [127.0.0.1] localhost

Return-Path: <email@mydomain.com>
From: =?UTF-8?Q?=D8=A7=D8=A8=D9=88_=D8=A8=D8=AF=D8=B1?=
  <email@mydomain.com>
Message-ID: <8f49efa3f63d3c2e0dfd3a8df5ae7495@mydomain.com>
User-Agent: Roundcube Webmail
Subject: =?UTF-8?Q?Re=3A_=5BSPAM=5D_Re=3A_=D9=87=D8=A7=D9=85_=7C_=D9=85?=
  =?UTF-8?Q?=D9=88=D8=B9=D8=AF_=D9=88=D8=B5=D9=88=D9=84_=D8=A7=D9=88=D9=84_?=
  =?UTF-8?Q?=D8=AF=D9=81=D8=B9=D8=A9_=D9=85=D9=86_=D8=B3=D8=A7=D8=A6=D9=82?=
  =?UTF-8?Q?=D9=8A=D9=86=28_=D9=86=D9=82=D9=84_=D8=A7=D9=84=D8=A8=D8=B6?=
  =?UTF-8?Q?=D8=A7=D8=A6=D8=B9_=29?=
Not quarantined.

The message WILL BE relayed to:
<reciever@mydomain.com>

Spam scanner report:
Spam detection software, running on the system "mydomain.com",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  نعم يتسع للدفعه القادمه فقط ولكن
   Ù„ابد من سرعة انهاء اجراءات الموجودين لتوفير
   Ù…ساØه للدفعات القادمه بعد ذلك وشكراً

Content analysis details:   (9.0 points, 5.0 required)

pts rule name              description
---- ---------------------- --------------------------------------------------
-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
  10 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                            [URIs: mydomain.com]
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
                            identical to background
0.0 HTML_MESSAGE           BODY: HTML included in message
0.0 T_KAM_HTML_FONT_INVALID Test for Invalidly Named or Formatted
                            Colors in HTML
Return-Path: <email@mydomain.com>
Received: from localhost (localhost [127.0.0.1])
    by mydomain.com (Postfix) with ESMTPSA id 4KHHzm1kN0z2hMcp;
    Mon, 14 Mar 2022 16:52:52 +0300 (+03)
MIME-Version: 1.0
Date: Mon, 14 Mar 2022 16:52:52 +0300
From: =?UTF-8?Q?=D8=A7=D8=A8=D9=88_=D8=A8=D8=AF=D8=B1?=
<email@mydomain.com>
To: =?UTF-8?Q?=D8=B4=D8=A7=D8=AF=D9=86_=D8=A7=D9=84=D9=82=D8=AD=D8=B7?=
=?UTF-8?Q?=D8=A7=D9=86=D9=8A?= <email@mydomain.com>
Cc: =?UTF-8?Q?=D8=AA=D8=B1=D9=83=D9=8A_=D8=A7=D9=84=D8=B4=D8=A7=D9=8A?=
=?UTF-8?Q?=D9=81?= <email.mydomain.com>, =?UTF-8?Q?=D8=B9?=
=?UTF-8?Q?=D8=A8=D8=AF=D8=A7=D9=84=D8=B1=D8=AD=D9=85=D9=86_=D8=B4=D9=87?=
=?UTF-8?Q?=D8=B1=D8=AE=D8=A7=D9=86=D9=8A?= <email@mydomain.com>,
=?UTF-8?Q?=D8=B9=D8=A8=D8=AF=D8=A7=D9=84=D8=B9=D8=B2=D9=8A=D8=B2_=D8=A7?=
=?UTF-8?Q?=D9=84=D8=AF=D9=88=D8=B3=D8=B1=D9=8A?=
<email@mydomain.com>, =?UTF-8?Q?=D8=A5=D8=AF=D8=A7=D8=B1?=
=?UTF-8?Q?=D8=A9_=D8=A7=D9=84=D9=85=D9=88=D8=A7=D8=B1=D8=AF_=D8=A7=D9=84?=
=?UTF-8?Q?=D8=A8=D8=B4=D8=B1=D9=8A=D8=A9?= <email@mydomain.com>,
<email@mydomain.com>, =?UTF-8?Q?=D9=85=D8=B4?=
=?UTF-8?Q?=D8=A7=D8=B9=D9=84_=D8=A7=D9=84=D8=B9=D8=AA=D9=8A=D8=A8=D9=8A?=
<email@mydomain.com>, =?UTF-8?Q?=D8=A7=D9=84=D8=AC=D9=86?=
=?UTF-8?Q?=D8=A7=D8=AF=D8=B1=D9=8A=D8=A9_-_BX?= <email@mydomain.com>
Subject: =?UTF-8?Q?Re=3A_=5BSPAM=5D_Re=3A_=D9=87=D8=A7=D9=85_=7C_=D9=85?=
=?UTF-8?Q?=D9=88=D8=B9=D8=AF_=D9=88=D8=B5=D9=88=D9=84_=D8=A7=D9=88=D9=84_?=
=?UTF-8?Q?=D8=AF=D9=81=D8=B9=D8=A9_=D9=85=D9=86_=D8=B3=D8=A7=D8=A6=D9=82?=
=?UTF-8?Q?=D9=8A=D9=86=28_=D9=86=D9=82=D9=84_=D8=A7=D9=84=D8=A8=D8=B6?=
=?UTF-8?Q?=D8=A7=D8=A6=D8=B9_=29?=
In-Reply-To: <CAN6=fX=BTi+-FGe50d9fow3P96rQ+4TvS6-vvGepcaNqJJ=eCg@mail.gmail.com>
References: <CAN6=fXmk7OB5c2S4Y7trKVG0g0=u9TxajMCtWtBko3UUeqeM8g@mail.gmail.com>
<CAN6=fXkfp0hJL9tY1efg4o1uA9+HGxavbb=m9gtH+XqD+G-btw@mail.gmail.com>
<CAGwTRMveg2_B3b3V+TQ15aakJa_+4UoUgfZ5s-NP8bMtnK7VVA@mail.gmail.com>
<CAN6=fXnJ=xmvmWL0MnmJ_1emr=pR9c4M+MHuyvAh94vHJXd6pg@mail.gmail.com>
<CAN6=fXn8C3Ayu57qin5t5uL9AU+WF6a4V47Yq2K7cvHU-JL_1Q@mail.gmail.com>
<9bd5f64f38aef589ed7c235c7d75d4a2@mail.gmail.com>
<CAN6=fX=xhQXJC4V0zBFX7QYw7QRTLhRXAUccz92E+AH0OkcqKQ@mail.gmail.com>
<CAN6=fX=C36xeif5gegQZrpMo-B_NLaZZ8MKW5z58UyjDmMq2Ug@mail.gmail.com>
<a021e7ddd47d0891a55edd7440bec740@mydomain.com>
<CAN6=fXkTWgJH5-60jeVeUz4BoV2sa2x0Y+vqad_CYWjtVaEqwA@mail.gmail.com>
<f2e020742b0d3de43df735cc6816e73b@mydomain.com>
<0ac6f308756fae8972836a7df0f59d89@mydomain.com>
<f217889fa981860198fd0ac8b11840d1@mail.gmail.com>
<6dd4a994f69b3429f13b685ef33dfbaf@mydomain.com>
<CAN6=fX=BTi+-FGe50d9fow3P96rQ+4TvS6-vvGepcaNqJJ=eCg@mail.gmail.com>
User-Agent: Roundcube Webmail
Message-ID: <8f49efa3f63d3c2e0dfd3a8df5ae7495@mydomain.com>
X-Sender: email@mydomain.com
Organization: Our Company
Content-Type: multipart/alternative;
boundary="=_c6bffa68f7091e2e168b4fd7937d7d0c"

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Spam FROM LOCAL [127.0.0.1]:36396 - postmaster

Check this in report:

10 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                            [URIs: mydomain.com]

3

Re: Spam FROM LOCAL [127.0.0.1]:36396 - postmaster

ZhangHuangbin wrote:

Check this in report:

10 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                            [URIs: mydomain.com]


Hi Zhang,

Our domain is not listed in spam Database lookup:
dnsbl.info
mxtoolbox.com

note: message status=sent from /var/log/maillog.

Another thing is that, sometimes certain employees email at the branch is not receiving email specially with attachment. How can i resolve this issue. I am searching from the forum and applied some fix but to no avail.

Thanks,
Jung

4

Re: Spam FROM LOCAL [127.0.0.1]:36396 - postmaster

jung wrote:

Our domain is not listed in spam Database lookup:

SpamAssassin reports the URL was found in one of spam URL database site.

jung wrote:

Another thing is that, sometimes certain employees email at the branch is not receiving email specially with attachment. How can i resolve this issue. I am searching from the forum and applied some fix but to no avail.

Cannot help much without related Postfix log lines.