received an email from a spammer addressed to a non-existent user in my domain, let's call it example.com. obviously the headers had been spoofed but i must assume the 'rcpt to' field was legit for it to reach me. i have all messages forwarded to my gmail from my domain's sendmail.
trouble is nothing in the message source in gmail is showing which of my the legit email addresses the spammer specified to reach me. all i see in the message source is the bogus email. i can't reproduce this either. this is the first 'received from' part:
> Received: from SQSZJWGPY ([1.52.114.198])
> by example.com (8.14.4/8.14.4) with ESMTP id s5PEIUCI003583;
> Wed, 25 Jun 2014 10:18:31 -0400
in all other emails the last line looks something like this:
for me#example.com; Wed, 25 Jun 2014 10:32:11 -0400
so the legit email is revealed. i know the envelope is not included in the message source but there must be a way to find out what the 'rcpt to' value was without going into sendmail logging and what not. how did the spammer hide the email he specified?
The contents of an email message, specifically, the to, cc and from headers, don't necessarily correspond to the envelope mail from and rcpt to of the message. The SMTP protocol, specified in RFC 5321, is where the envelope data is sent.
The message contents, specified in RFC 5322, contain the message headers and message body. The headers are where you find the to, cc and from headers that we usually use to identify out who sent the message and who else received the message.
However, there is nothing requiring that the from, to and cc headers match to the envelope mail from or rcpt to, though well behaved mail software will often have the association made clear. I say "often" because, for example, when you blind carbon copy (BCC) somebody on your message, your mail client will not include these recipients in the to or cc headers.
In your case, the rcpt to specified to sendmail is not put into a header by default, so is probably lost. If you really don't want to look into the sendmail logs you are probably out of luck for this one message.
If you expect you will continue to receive similar messages you could instruct sendmail to add the envelope rcpt to into a header. Then, without looking at the sendmail logs, you will have the rcpt to in a X-Envelope-To header.
The spammer probably has a SMTP server where he has a email account configured as administrator, then he probably can send emails from different senders. The SMTP server probably doesn't have some filters to control the output and input emails, then if you are an administrator of this server, you can send emails from sender like "example#yahoo.com" even if your domain name isn't yahoo.com. Once, some partners and I did a test in a company (customer) to demonstrate that their SMTP server can be victim from a phishing attack, we could send emails from different senders with different domain name.
I hope this information to help you.
Good luck.
after much testing and trial and error i have found the answer to my own question. bear in mind that i use sendmail 8.14.4 (5 years old) and i haven't done much tweaking to the sendmail.mc file.
if during the smtp session the sender specifies a non-existent account in the 'rcpt to' line followed by a valid one, the recipient's address is masked in the headers. e.g.
mail from: spammer#example.com
250 2.1.0 spammer#example.com... Sender ok
rcpt to: bad
550 5.1.1 bad... User unknown
rcpt to: good
250 2.1.5 good... Recipient ok
data
354 Enter mail, end with "." on a line by itself
looks good?
.
250 2.0.0 s5UHeBOj004847 Message accepted for delivery
the message arrives to user 'good' and nowhere in the header (or elsewhere in the message) it is indicated that it was sent to 'good'.
maybe spammers are doing this accidentally or deliberately, but they are doing it and this can be reproduced every time using above method, at least with my sendmail version.
that's all
Related
So far my main.cf contained, primarily, two following lines:
local_recipient_maps =
luser_relay = mrjoe#mydomain.com
These settings are responsible for delivering all emails sent to any address in my domain like random_string#mydomain.com to my real account mrjoe#mydomain.com. This worked and I was receiving emails only from websites where I signed up with any of my unlimited aliases.
I realized that I don't want to receive all these emails, so I came up with an idea to discard emails sent to particular alias instead of blocking a particular sender. In this way, I can protect myself from any future unwanted email and somehow make this alias disabled.
To bring this idea to life I removed the previous two lines from main.cf and added the following one:
virtual_alias_maps = pcre:/etc/postfix/virtual_alias
The virtual_alias file has following content:
/^((?!^(blacklisted_address|another_blacklisted)#).)*$/ mrjoe#mydomain.com
This configuration redirects all emails sent to addresses other than blacklisted_address#mydomain.com and another_blclisted#mydomain.com to specified real address mrjoe#mydomain.com.
This works, emails sent to listed addresses are not delivered to my inbox. The problem is that now I started to receive hundreds of spam emails, none of which I received before.
Here is one example of such spam message:
From secretariat#solid-app-api.be Wed May 29 01:23:10 2019
Return-Path: <secretariat#solid-app-api.be>
X-Original-To: mrsnorah11#gmail.com
Delivered-To: mrjoe#mydomain.com
Content-Type: text/plain; charset="iso-8859-1"
Content-Description: Mail message body
Subject: 21.21.21.21 // my IP here
To: Recipients <secretariat#solid-app-api.be>
From: "Agent MacLeod" <secretariat#solid-app-api.be>
Date: Tue, 28 May 2019 16:23:10 -0700
X-UID: 1194
Content-Length: 3686
Status: RO
So the question is: why did I start to receive hundreds of spam messages after making changes described above? How is it possible that now messages with X-Original-To header different than #mydomain.com are delivered to my domain?
As for now, I brought back the previous configuration and I no longer receive spam messages. Clearly, this is not an acceptable solution.
In your old config, luser_relay delivered all "mail for unknown recipients in domains that match $mydestination, $inet_interfaces or $proxy_interfaces" (thus your domain) to your mailbox.
Your new configuration accepts mails for any recipient domain. The regex matches any email address except the blacklisted ones. All mails forwarded to your address mrjoe#mydomain.com, hence the X-Original-To header.
Spammers send mails with other repients (like gmail.com) to your server because your server accepts it. They think that you're running an open relay (which you probably don't).
We are trying to figure out how to reduce the amount of bounces for our email platform and, one of the solutions we've found on the internet is to, via telnet, verify if the email exists.
So, for this example, we connect to the MX:
telnet alt4.aspmx.l.google.com 25
We start the communication:
helo hi
And, for every email we try (valid and invalid ones), we always receive the same response:
mail from: <fsafsaffsf#FasgagaoaSFasfas.co>
250 2.1.0 OK d8si998940wrc.143 - gsmtp
Are they doing this to prevent maybe a possible listing of valid emails?
What is the best way to verify if an email is valid before sending an email to it? We need this because our clients often uploads a spreadsheet with customer emails and always one or two of them are mistyped.
Thanks.
For a given recipient email address, you can:
extract its domain name (everything after #)
query DNS for the MX record(s) of that domain
for each specified server, connect and issue a VRFY command (see RFC 5321 Section 3.5), asking the server to verify the email address.
stop when you get a success reply.
However, SMTP servers are not required to implement VRFY. The simpler solution would be to just send the email normally, and then handle any errors from the RCPT TO command, and also handle the possibility that you simply can't always detect delivery errors in real time. If the email has to be relayed across servers, it might not fail on the server you use for sending, it may not fail until it is relayed to another server after you have already ended your SMTP session. In which case, the only way to detect delivery errors is to monitor your inbound mailbox for delivery failure emails being sent back to you.
I use dnsimple to host my DNS and have valid SPF, DKIM, and DMARC records to validate my emails sent from Zoho. However, Whenever I send emails to an #ucdavis.edu account I get an Undelivered Mail response
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its recipients. This is a permanent error.
lsmiyashita#ucdavis.edu, ERROR_CODE :550, ERROR_CODE :5.7.1 <admin#study.space>... Access denied
Received:from mail.zoho.com by mx.zohomail.com
with SMTP id 1478675695600485.6815385213283; Tue, 8 Nov 2016 23:14:55 -0800 (PST)
Message-ID:<15847f087ed.112901d8e106580.9166398699723335101#study.space>
Date:Tue, 08 Nov 2016 23:14:55 -0800
From:Jacob Bevilacqua <admin#study.space>
User-Agent:Zoho Mail
To:"lsmiyashita" <lsmiyashita#ucdavis.edu>
Subject:Here's a little test for you.
Content-Type:multipart/alternative;
boundary="----=_Part_335760_1020694757.1478675695597"
I have tried several different hosts (GSuite, MailGun, & Zoho) and I get the same issue. I checked and I am not blacklisted on any sites. I ran a test at mail-tester.com and got a 10/10. Why won't my messages deliver.
I verified that the email address you are sending to is valid: Verified Email Address
So like #Synchro says, they just don't like you. It's always a challenge to figure out the exact reason, but contacting their admins is the right way to go. I have a feeling it's because of the .space domain ending, they probably haven't updated the list of domain endings they accept.
Anyway, if you wanted to do additional mail testing, use this Mail Tester.
You are under the unfortunate illusion that it's your fault. A 5.7.1 error means that they just don't like you, and they don't have to give a reason. Welcome to the world of deliverability, or lack thereof. Well-behaved mailers are often punished for no particular reason. If it's just this domain, your best bet might be to contact their admins.
I'm having a problem getting emails to bounce to a specific email address, different to the From address.
A particular client requires that we send emails from a specific email address (call it contact#clientcompany.com). Our Exchange admins have created an account on the Exchange box so that we can log in and send from that address. Our Exchange server is spoofing that address / domain. This works fine.
Unfortunately the emails sent from contact#clientcompany.com are not bouncing back to us. They are presumably bouncing back to the contact account at clientcompany.com (which may or may not exist).
I've inserted a header Return-Path=kirk.broadhurst#mycompany.com with the assumption that this field determines where bouncebacks are sent. Other documents indicate that this field should never be populated by the originating SMTP system. Other websites again talk about a field called Errors-To which is apparently non-standard.
So - which field is the correct one, and what does it depend on?
Any ideas why my Return-Path is not working?
I'd really like to get Exchange to correctly bounce a message addressed to an invalid server!
update:
Continuing to dig, and my Return-Path work was only adding an extended property at the end of the header block, but Exchange appears to be still adding its own Return-Path value at the top.
Delivered-To: test#test.com
Received: by 1.1.1.1 with SMTP ...
Return-Path: <contact#clientcomapny.com>
Received: from ... ...
...
Subject: Test
Message-ID: ...
Return-Path: kirk.broadhurst#mycompany.com
According to the Microsoft.com, I cannot set the Return-Path as it is determined by the MAIL FROM - which seems consistent with what I've previously read. But now I'm stuck - how do I change this MAIL FROM value programmatically within Exchange 2007?
You might want to check if the header is correctly set. Check the headers of your email and look for:
Return-Path: kirk.broadhurst#mycompany.com
Return-Path is the correct field according to RFC (IIRC) but not all Mail Servers implement that correctly.
Out of luck ;) The sender is where bounces end up. The client should create the mailbox and forward it to your internal bounce mailbox. Only clear solution.
If a human is replying to the e-mail, and not an automated response, you may want to try using the header "Reply-To:" instead of "Return-Path:". (For example: "Reply-To: kirk.broadhurst#mycompany.com")
On our mailing application we are sending emails with the following header:
FROM: marketing#customer.com
TO: subscriber1#domain1.example
Return-PATH: bouncemgmt#ourcompany.example
The problem that we are facing is that some email servers will bounce back a message immediately and use the from or reverse path (marketing#customer.example) instead to our bounce mgmt server. We want to know if we modify in the header the reply-to to be the same as the return-path if we will be able to catch all bounces.
Any other ideas are welcome?
We are using the following documents as references:
VERP
RFC
Bounce Messages
SMTP Log Parsing to get Bounces
EDIT 1: A few more bits of information to see if we can get this resolve.
We want to know at what point the email server relaying the message will choose to use the reply-to versus the return-path. We have notice that when the first SMTP server relaying the message gets rejected it sends it to the reply-to, but when it happens after one hop it sends it to the return-path.
Let's start with a simple example. Let's say you have an email list, that is going to send out the following RFC2822 content.
From: <coolstuff#mymailinglist.example>
To: <you#example.com>
Subject: Super simple email
Reply-To: <coolstuff-threadId=123#mymailinglist.example>
This is a very simple body.
Now, let's say you are going to send it from a mailing list, that implements VERP (or some other bounce tracking mechanism that uses a different return-path). Lets say it will have a return-path of coolstuff-you=yourcompany.com#mymailinglist.example. The SMTP session might look like:
{S}220 workstation1 Microsoft ESMTP MAIL Service
{C}HELO workstation1
{S}250 workstation1 Hello [127.0.0.1]
{C}MAIL FROM:<coolstuff-you=yourcompany.com#mymailinglist.example>
{S}250 2.1.0 me#mycompany.com....Sender OK
{C}RCPT TO:<you#example.com>
{S}250 2.1.5 you#example.com
{C}DATA
{S}354 Start mail input; end with <CRLF>.<CRLF>
{C}From: <coolstuff#mymailinglist.example>
To: <you#example.com>
Subject: Super simple email
Reply-To: <coolstuff-threadId=123#mymailinglist.example>
This is a very simple body.
.
{S}250 Queued mail for delivery
{C}QUIT
{S}221 Service closing transmission channel
Where {C} and {S} represent Client and Server commands, respectively.
The recipient's mail would look like:
Return-Path: coolstuff-you=yourcompany.com#mymailinglist.example
From: <coolstuff#mymailinglist.example>
To: <you#example.com>
Subject: Super simple email
Reply-To: <coolstuff-threadId=123#mymailinglist.example>
This is a very simple body.
Now, let's describe the different "FROM"s.
The return path (sometimes called the reverse path, envelope sender, or envelope from — all of these terms can be used interchangeably) is the value used in the SMTP session in the MAIL FROM command. As you can see, this does not need to be the same value that is found in the message headers. Only the recipient's mail server is supposed to add a Return-Path header to the top of the email. This records the actual Return-Path sender during the SMTP session. If a Return-Path header already exists in the message, then that header is removed and replaced by the recipient's mail server.
All bounces that occur during the SMTP session should go back to the Return-Path address. Some servers may accept all email, and then queue it locally, until it has a free thread to deliver it to the recipient's mailbox. If the recipient doesn't exist, it should bounce it back to the recorded Return-Path value.
Note, not all mail servers obey this rule; Some mail servers will bounce it back to the FROM address.
The FROM address is the value found in the FROM header. This is supposed to be who the message is FROM. This is what you see as the "FROM" in most mail clients. If an email does not have a Reply-To header, then all human (mail client) replies should go back to the FROM address.
The Reply-To header is added by the sender (or the sender's software). It is where all human replies should be addressed too. Basically, when the user clicks "reply", the Reply-To value should be the value used as the recipient of the newly composed email. The Reply-To value should not be used by any server. It is meant for client-side (MUA) use only.
However, as you can tell, not all mail servers obey the RFC standards or recommendations.
Hopefully this should help clear things up. However, if I missed anything, let me know, and I'll try to answer.
Another way to think about Return-Path vs Reply-To is to compare it to snail mail.
When you send an envelope in the mail, you specify a return address. If the recipient does not exist or refuses your mail, the postmaster returns the envelope back to the return address. For email, the return address is the Return-Path.
Inside of the envelope might be a letter and inside of the letter it may direct the recipient to "Send correspondence to example address". For email, the example address is the Reply-To.
In essence, a Postage Return Address is comparable to SMTP's Return-Path header and SMTP's Reply-To header is similar to the replying instructions contained in a letter.
for those who got here because the title of the question:
I use Reply-To: address with webforms. when someone fills out the form, the webpage sends an automatic email to the page's owner. the From: is the automatic mail sender's address, so the owner knows it is from the webform. but the Reply-To: address is the one filled in in the form by the user, so the owner can just hit reply to contact them.
I had to add a Return-Path header in emails send by a Redmine instance.
I agree with greatwolf only the sender can determine a correct (non default) Return-Path.
The case is the following:
E-mails are send with the default email address: admin#example.com
But we want that the real user initiating the action receives the bounce emails, because he will be the one knowing how to fix wrong recipients emails (and not the application adminstrators that have other cats to whip :-) ).
We use this and it works perfectly well with exim on the application server and zimbra as the final company mail server.