Exim backscatter spam with BOUNCE messages.

kotel

kotel

Verified User
Joined
Sep 15, 2006
Messages
35
Location
Russia
I have abuse about spam, it's says :
Your server send more bounce messages, who contains spam.
Please shut down bounce messages, or we will block your 25 port.

I use this instructions (http://help.directadmin.com/item.php?id=145) for problem solving.But It's NOT working.
Exim already send mail with error,and original message.

How i can disable BOUNCE message? Any means?

Server:
FreeBSD 6.3
Exim 4.68 + dovecot 1.0.10
 
By default DirectAdmin does NOT send back any email, spam or not, once it's received it. Are you using SpamBlocker to not accept email containing spam? Can you trace the email to find how it's getting on to your server?

Jeff
 
kotel said:
I have abuse about spam, it's says :
Your server send more bounce messages, who contains spam.
Please shut down bounce messages, or we will block your 25 port.

I use this instructions (http://help.directadmin.com/item.php?id=145) for problem solving.But It's NOT working.
Exim already send mail with error,and original message.

How i can disable BOUNCE message? Any means?
Click to expand...

Try this construction

accept domains = +local_domains
endpass
message = unknown user
verify = recipient
 
Denis, can you please tell me what this does? DirectAdmin by default won't accept email if the recipient doesn't have a mailbox on the server.

Thanks.

Jeff
 
TS explained that he don't like, that exim sending bounce messages.
He also said, that bounce_return_message = false
is not working. And it is true!

Nobody says that exim want to accept email if the recipient doesn't have a mailbox on the server. It is really don't want. But it sends the bounce and do it itself, but this should make the sender's MTA.

You really never heard about the problem with SpamCop?
kotel is not the first, who asked about it. I saw here a lot of messages about this "bounce" problem, but it is not always possible to recognize correctly what people wants. That is why their questions was without answers. But I was able to recognize question, because I already decided this problem for my customers, who asked me to tune servers.

I can say more about this problem.
I was faced with this problem the first time about 3 years ago

-----Original Message-----
From: Spam Victim [mailto:[email protected]]
Sent: Tuesday, February 21, 2006 7:21 AM
To: abuse@ISP_here
Subject: [SpamCop (IP_here) id:1665998377]Mail delivery failed:
returning message to sender

[ SpamCop V1.517 ]
This message is brief for your comfort. Please use links below for details.

Unsolicited bounce from: IP_here
http://www.spamcop.net/w3m?i=z1665998377zc71eaf8ecbd7c9b90e99aad6eb9211e6z
IP_here appears to be sending unsolicited bounces, please see:
http://www.spamcop.net/fom-serve/cache/329.html

If you go to the URL, you will find what they think about bounces
3 year ago I tried to explain them that we can't shutdown bounces, because users want it. I have a long correspondence with them and we agreed that they would not block the IP any more and send notifications.

I found, that it is too hard to dispute with SpamCop. It seams that there is the same manager, that was 3 years ago - Ellen. One customer asked to help him now, and I discussed problem with SpamCop, but without results.

At present time SpamCop even can call your server "open proxy" because of the bounces.

-----Original Message-----
From: Jjacky Comforty [mailto:[email protected]]
Sent: Tuesday, March 31, 2009 11:50 PM
To: postmaster@ISP_here
Subject: [SpamCop (IP_here) id:3990926235][SPAM] Mail delivery failed:
returning message to ..

[ SpamCop V4.5.0.101 ]
This message is brief for your comfort. Please use links below for details.

Unsolicited bounce from: IP_here
http://www.spamcop.net/w3m?i=CODE_here
P_here is open proxy, see: http://www.spamcop.net/mky-proxies.html

[ Offending message ]
Received: from server.domain_here (server.domain_here [IP_here])
by impregnable.cnchost.com (ConcentricHost(4.0.r14942) MX) with
ESMTP id 486A09468.0CT4SUPGB600
for <x>;
Tue, 31 Mar 2009 15:49:56 -0400 (EDT)
Received: (ConcentricHost mdeliver 3.0 filtering [VuRuYPCP] on
[impregnable.cnchost.com]);
with ESMTP id 486A09468 for <x>; Tue, 31 Mar 2009 15:50:03 -0400
(EDT)
Received: from mail by server.domain_here with local (Exim 4.69)
id 1LojxO-000PhY-F1
for x; Tue, 31 Mar 2009 23:49:10 +0400
Return-Path: <[email protected]>
From: "Mail Delivery System" <[email protected]>
To: <x>
Subject: [SPAM] Mail delivery failed: returning message to sender
Date: Tue, 31 Mar 2009 22:49:10 +0300
Message-ID: <[email protected]_here >
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 12.0
X-Concentric-MX-Info: s=0CT4SUPGB600:1 ts=0 td=16 dt=0 tro=1 tra=1 trb=0
sro=1 sra=1 ic=0
X-Concentric-DKIM: SigStatus="No signature", PolSusp="No", PolTest="No",
Policy="none", Handling="none"
X-JunkMail: NotJunk N0.014X0.511 49D273EB91845BE9
X-UIDL: 109867
Thread-Index: AcmyOeHsVmL4UQwvRzymTs+hcQeRCw==
X-Failed-Recipients: here_addresses

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

here_addresses

3 years ago I didn't want to stop bounces. But some times ago I decided, that it is really good idea to stop bounce at all from receiver's MTA. I started looking for how to solve this problem for DA's exim configuration and found it.

If somebody now wants to send email to my customer's server (rcp_SERVER) for non existence mailbox, he will get answer from their own MTA (sender_SERVER), because rcp_SERVER answer "550 unknown user". So, no more bounces from rcp_SERVER and no more problem with SpamCop about this matters.

Here you can see "log's explanation"

cat /var/log/exim/mainlog.0 |grep 1Lp9uA-0001Xr-Ga
2009-04-02 03:31:34 1Lp9uA-0001Xr-Ga <= VICTIM_EMAIL H=XXX (XXX) [XXX] P=esmtp S=707 [email protected] T="test67" from <VICTIM_EMAIL> for testffdf456d@REAL_DOMAIN.ru
2009-04-02 03:31:45 1Lp9uA-0001Xr-Ga ** testffdf456d@REAL_DOMAIN.ru F=<VICTIM_EMAIL> R=lookuphost T=remote_smtp: SMTP error from remote mail server after RCPT TO:<testffdf456d@REAL_DOMAIN.ru>: host rcp_SERVER [rcp_SERVER_IP]: 550 unknown user
2009-04-02 03:31:45 1Lp9uL-0001YE-0t <= <> R=1Lp9uA-0001Xr-Ga U=mail P=local S=1528 T="Mail delivery failed: returning message to sender" from <> for VICTIM_EMAIL
2009-04-02 03:31:45 1Lp9uA-0001Xr-Ga Completed


cat /var/log/exim/mainlog.0 |grep 1Lp9uL-0001YE-0t
2009-04-02 03:31:45 1Lp9uL-0001YE-0t <= <> R=1Lp9uA-0001Xr-Ga U=mail P=local S=1528 T="Mail delivery failed: returning message to sender" from <> for VICTIM_EMAIL
2009-04-02 03:31:45 1Lp9uL-0001YE-0t => VICTIM_EMAIL F=<> R=lookuphost T=remote_smtp S=1570 H=sender_SERVER [sender_SERVER_IP] C="250 2.0.0 Ok: queued as: 21bb9109c96bc24"
2009-04-02 03:31:45 1Lp9uL-0001YE-0t Completed
 
I actually read your entire post, Denis, and I still don't understand exactly what it is you want.

Are you saying that your own customers are complaining to SpamCop when they get bounces? If so, then that's a contractual issue between you and your customers; you can certainly receive their bounces for them, or /dev/null them with a simple exim spam filter rule.

If not, then please try explain simply as follows:

Are these bounces that you're getting from someone? If so, did they originally receive from you the email that they're bouncing? If so, then you need to find out why you're sending out emails that are being bounced back to you.

If you didn't send out the emails that are being bounced back to you, but instead are an innocent victim of someone bouncing back emails to you that didn't come from you, and now you're stuck because your server is trying to bounce them back to an address that didn't send them, then yes, that problem should be fixed.

Are you saying that this construct:
Code: 
accept domains = +local_domains
endpass
message = unknown user
verify = recipient
fixes it? If so, then please tell me where you put the code in the exim.conf file.

Please do NOT post the entire exim.conf file. If you can't describe where it goes then attach it to a reply to this post and I'll look at it. You may need to rename it to exim.conf.txt to attach it.

But if so, note that I won't read the entire file; I'll simply search for your code.

Thanks.

Jeff
 
My customers - just people, who order from me setting the server. I am talking about servers, not about problem between customer and me. I do not know how to explain another simply way. I can try to show the problem on your server. To do this, tell me a non-existent mailbox on your server and tell me the email address you want to become a victim (not on the same server). I will send spam to this victim using your server. Let's try to do experiment.
 
Last edited:
You didn't answer my question; did your code fix it? If so, where did you put it?

Before I'll try your experiment tell me exactly what you're doing and what I'll find on my server.

Jeff
 
This code fix so called "SpamCop problem" - unsolicited bounces... I hope at all...

I put it in the begging of ACL

begin acl

# ACL that is used after the RCPT command
check_recipient:

# stop bounce from us, lets do it by sender's server
accept domains = +local_domains
endpass
message = unknown user
verify = recipient


I tried to search some threads about same problem in google.

http://www.gossamer-threads.com/lists/exim/users/74968
http://www.gossamer-threads.com/lists/exim/users/60619
http://www.gossamer-threads.com/lists/exim/users/77407
http://www.opensubscriber.com/message/[email protected]/4688127.html
http://www.webhostingtalk.com/showthread.php?t=682682
One for Russians readers: https://forum.ru-board.com/topic.cgi?forum=11&topic=4058

I think, you should look at them. It will help you to understand what is the problem.
 
Last edited:
jlasman said:
Before I'll try your experiment tell me exactly what you're doing and what I'll find on my server.
Click to expand...

I will send email with advertise to a non-existent mailbox on your server, and put victim's address to the FROM and REPLY-TO. Your server will send this advertising to the victim. And then, the victim will complain to spamcop. ;)
 
I now understand the problem. I'll test your code in my personal copy of exim.conf; if if it doesn't cause other problems I'll put it into the masters for us and for DirectAdmin as well.

Jeff
 
diradmin said:
This code fix so called "SpamCop problem" - unsolicited bounces... I hope at all...

I put it in the begging of ACL

begin acl

# ACL that is used after the RCPT command
check_recipient:

# stop bounce from us, lets do it by sender's server
accept domains = +local_domains
endpass
message = unknown user
verify = recipient


I tried to search some threads about same problem in google.

http://www.gossamer-threads.com/lists/exim/users/74968
http://www.gossamer-threads.com/lists/exim/users/60619
http://www.gossamer-threads.com/lists/exim/users/77407
http://www.opensubscriber.com/message/[email protected]/4688127.html
http://www.webhostingtalk.com/showthread.php?t=682682
One for Russians readers: https://forum.ru-board.com/topic.cgi?forum=11&topic=4058

I think, you should look at them. It will help you to understand what is the problem.
Click to expand...

I know this is old but I thought I would give it a try. I just tried this and it still will bounce to a forged email address.
 
I already don't remember was it the only what you need to change but now I have next options:

Code: 
bounce_return_message = false
bounce_return_body = false

check_recipient:

# stop bounce from us, lets do it by sender's server
    accept domains = +local_domains
    endpass
    message = unknown user
    verify = recipient

# we accept if the source is local SMTP (i.e. not over TCP/IP).
# We do this by testing for an empty sending host field.
    accept  hosts = :

# if somebody send something like T="Mail delivery failed: returning message to sender" from <> or other with empty "from"

    deny    senders = :
    message = A valid sender header is required for bounces
##    !verify  = header_sender

and don't have problems with spam (bounces).

So, try it. If you still have problems, than it can be related with something else. For ex., sending spam through the sockets. It's also looks like bounce. I have professional solution for that ;)
 
I was about to respond that I could not get it to work but then I realized my main problem with it is that I was sending to a postmaster address which has its own problems. Let me try a another non-existent address and see what happens.
 
Thanks, Floyd. And also help me with your thoughts on how I should handle postmaster addresses.

Jeff
 
For postmaster I'm using that

Code: 
+#  accept  local_parts = postmaster
+#          domains     = +local_domains
;)

Somebody can say that it is not with RFC standards, but it also help to avoid spam
 
jlasman said:
Thanks, Floyd. And also help me with your thoughts on how I should handle postmaster addresses.

Jeff
Click to expand...

My thoughts are that postmaster should be set up for each domain hosted that way it is a deliverable address.

For now I have done as diradmin has done and commented out the accepting of postmaster. However it does not break RFC as long as each domain hosted is set up with postmaster addresses.

What I plan on doing is write a script to check for postmaster addresses in the domain's aliases file and if none exist then I will insert one and have it blackhole. If the user at some point decides he wants to start accepting the postmaster mail then he can change it.

The above could be wrong. Maybe it is the server admin that should be receiving all the postmaster mail. In that case I can set that up as well.

But whatever the case the postmaster mail should always be deliverable if exim is going to accept it. It should not accept it and find itself in the awkward position of not being able to deliver it OR reject it.
 
floyd said:
it does not break RFC as long as each domain hosted is set up with postmaster addresses.
Click to expand...

Ye, you are right
I was a little wrong about it.
I have in /etc/mail/aliases postmaster commented. It can break RFC. I was thinking about it when I wrote

But as for postmaster abuse and hostmaster in exim.conf.... I don't understand why they are there. They should not be. I commented all of them.
 
diradmin said:
But as for postmaster abuse and hostmaster in exim.conf.... I don't understand why they are there. They should not be. I commented all of them.
Click to expand...

Me too. It is my belief they are the cause of most of the backscatter now. The only other thing that can cause backscatter is forwarding to non-existent addresses. Also group mailling lists where everybody on the list can post can do it if there are some undeliverable addresses.
 
You must log in or register to reply here.
Back
Top