Some mails not scanned |
Post Reply 
|
| Author | |
jeroentiem 
Newbie 
Joined: 10 August 2007 Location: Netherlands Status: Offline Points: 3 |
 Post Options
 Thanks(0)
 Quote Reply
 Topic: Some mails not scannedPosted: 10 August 2007 at 4:36am |
|
Hi, How is it possible that i get mails that are not scanned by the spamserver? Received: from singnet.com.sg [121.6.28.58] by mycomp01.mycomp.com with ESMTP A scanned mail looks like this: Received: from mail2.mycomp.com [xx.xx.xx.140] by mycomp01.mycomp.com with ESMTP Jeroen Edited by LogSat - 11 August 2007 at 11:21am |
|
 |
|
|
WebGuyz
Senior Member 
Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
Post Options
Thanks(0)
Quote Reply
Posted: 10 August 2007 at 8:46am |
|
Not all spammers follow the rules and use your MX records to send emails. Many try to send directly to your mail server bypassing SF altogether or send to a backup MX if you have one that is not SF protected. You can block your mail servers port 25 or redirect it at the firewall to forward to SF and turn on SMTP authentication in SF. If your customers aren't doing SMTP auth now this can be a big pain, but its worth it to make sure what your describing does not happen. |
|
|
http://www.webguyz.net
|
|
|
|
|
sorfjord
Newbie
Joined: 22 August 2007 Status: Offline Points: 2 |
Post Options
Thanks(0)
Quote Reply
Posted: 22 August 2007 at 2:07pm |
|
Hi jeroentiem,
We just realized that someone is forging our domain ferndalelabs.com in spam. I found your posting with our server info in it. Have you received a lot of spam from our domain? If so, when did it start? Does your software give any other information on the route of the spam. We just want to get as much info as we can to make it stop!! Thanks |
|
|
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 22 August 2007 at 5:40pm |
|
sorfjord,
I can't speak on behalf of jeroentiem in regards to the frequency of the spam. However, looking from the headers he posted, this is the one showing the IP of the sender of the forged email: Received: from 200.82.37.216 by mail2.mycomp.com (LogSat Software SMTP Server - Unlicensed Evaluation Copy); Fri, 10 Aug 2007 10:20:33 +0200 As a side note, we recommend you implement SPF (Sender Policy Framework - see www.openspf.org) in the DNS for your domain. SPF is used by antispam vendors to reject emails that come from unauthorized sources. In simple terms, via DNS you establish what IPs are allowed to send emails on your behalf. Any email not coming from those IPs is treated as spam by email servers that support SPF. |
|
|
|
|
jeroentiem
Newbie
Joined: 10 August 2007 Location: Netherlands Status: Offline Points: 3 |
Post Options
Thanks(0)
Quote Reply
Posted: 22 August 2007 at 6:49pm |
|
WebGuyz thanks for your help, i blocked the port 25 on the end mailserver. All mx trick spam mails are blocked at this time. :-)
Sorfjord,
Two logs of your domain used for spamming:
08-10-07 10:20:28:391 -- (1188) Connection from: 200.82.37.216 - Originating country : Argentina
08-10-07 10:20:30:016 -- (1188) Resolving 200.82.37.216 - host216.200-82-37.telecom.net.ar 08-10-07 10:20:30:454 -- (1188) Mail from: jqocdj@ferndalelabs.com 08-10-07 10:20:30:454 -- (1188) - SPF analysis for ferndalelabs.com done: - none 08-22-07 02:58:03:665 -- (3560) Connection from: 189.137.187.25 - Originating country : Mexico
08-22-07 02:58:07:118 -- (3560) - IP address is from a blacklisted country... 08-22-07 02:58:07:118 -- (3560) 189.137.187.25 - Mail from: jqocdj@ferndalelabs.com To: Jeroen (a happy, now registered, user of the logsat spamfilter)
|
|
|
|
|
sorfjord
Newbie
Joined: 22 August 2007 Status: Offline Points: 2 |
Post Options
Thanks(0)
Quote Reply
Posted: 27 August 2007 at 1:19pm |
|
Thanks for the info.
|
|
|
|
Topic Options|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.224 seconds.