Are virtusertable receipient not logged in maillog

mfoley · 07-26-2022, 02:30 AM

I am using Sendmail. I am hosting a couple of domains on my server: myserver.org. One of the other domains is hisdom.com. The virtusertable has:

Code:

joe@hisdom.com joe@gmail.com

A spammer, hacku@hacker.com, has sent a message to joe@hisdom.com. This phishing message was delivered to joe@gmail.com. I'd like to block this sender, but I do not see any messages from hacku@hacker.com in the maillog. Do messages sent to people in the virtusertable simply get passed on with no record in maillog? Why else would there be no log entry for this sender?

bathory · 07-26-2022, 12:39 PM

Quote:

Originally Posted by mfoley

I am using Sendmail. I am hosting a couple of domains on my server: myserver.org. One of the other domains is hisdom.com. The virtusertable has:

Code:

joe@hisdom.com joe@gmail.com

A spammer, hacku@hacker.com, has sent a message to joe@hisdom.com. This phishing message was delivered to joe@gmail.com. I'd like to block this sender, but I do not see any messages from hacku@hacker.com in the maillog. Do messages sent to people in the virtusertable simply get passed on with no record in maillog? Why else would there be no log entry for this sender?

It should be logged in maillog.
You can search the logs for the email to joe@hisdom.com and then match the QID with the "from=..." line in order to find the sender.

Regards

elgrandeperro · 07-26-2022, 05:36 PM

First, look at the header to see if it actually went through your mailer. My experience is everything gets logged. You could easily test this by creating another virtual user and spoofing it (it can go to /dev/null for delivery).

You block with the access file/db. Make sure it is enabled in your config.