LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Unsolicited Bulk Email - Sendmail SMTP (https://www.linuxquestions.org/questions/linux-security-4/unsolicited-bulk-email-sendmail-smtp-859023/)

manutdfan1988 01-27-2011 09:15 AM

Unsolicited Bulk Email - Sendmail SMTP
 
Have just setup Sendmail working as an SMTP mail server on our Red Hat linux production box.

However one of our users has got the error message below when trying to send to another domain, this does not happen for all it seem like a security policy of the specific domain.

I understand the message, the external IP showing from the client is 53 and the external from the mail server is 51 and there is obviously a mismatch.

Could this be to do with the access policy of sendmail in that it RELAY's mail for the local domain, should this be set to something different to allow the send to originate from the mail server rather than the client PC.

First upstream SMTP client IP address: [XX.XX.127.51] According to a 'Received:' trace, the message apparently originated at:
[XX.XX.127.53], XXXXXXX ip-XX-XX-127-53.easynet.co.uk [XX.XX.127.53] (may
be forged)



Regards,

Noway2 01-27-2011 11:22 AM

For starters you will need to look at the FULL header. I suspect you will see something along the lines of received by xxx.53 from xxx.51. In other words, showing that it came from .51, through .53 to the end client. However, from what you have provided and my experience with mail servers, I don't think that this is the cause of the problem. More than likely, either your IP range is listed in a block that is banned by someone and the recipient is picking this up OR this particular recipient declares everybody SPAM, unless you are specifically declared as NOT SPAM.

manutdfan1988 02-09-2011 09:02 AM

Is there any way of making it look like the originator of the message is the server itself rather than the client PC?

The below appears in the message header

Code:

Received: from XXXCDT07 (ip-87-84-127-53.easynet.co.uk [87.84.127.53] (may be forged))
        by XXXWebServer.XXX.local (8.13.8/8.13.8) with ESMTP id p19FKFdj005100

Thanks


All times are GMT -5. The time now is 08:50 AM.