I'm not sure I've ever seen this before, and it's kind of a mystery.
User hits their daily email limit. Everything is fine up until that point, but once that daily email limit is hit, the `Envelope-to` is changed to my email address, and I receive the emails instead.
Here's a slightly redacted log:
Has anyone else seen this?
Version: DirectAdmin v.1.62.7
Stock exim.conf
Exim: 4.94.2
exim.conf update: yes, release 4.5
User hits their daily email limit. Everything is fine up until that point, but once that daily email limit is hit, the `Envelope-to` is changed to my email address, and I receive the emails instead.
Here's a slightly redacted log:
Code:
# From client to my server - it's fine
2021-09-10 13:19:32 1mOkBY-0008WK-7o <= [email protected] H=redacted.telus.net (DESKTOP5819TRQ) [50.99.XXX.XXX] P=esmtpsa X=TLS1.2:ECDHE-ECDSA-AES128-GCM-SHA256:128 CV=no A=login:[email protected] S=8568 [email protected] T="RE: New promotion from www.gets.com :15%off" from <[email protected]> for [email protected]
# From server to other server - it's fine
2021-09-10 13:19:33 1mOkBY-0008WK-7o => [email protected] F=<[email protected]> R=lookuphost T=remote_smtp S=9670 H=ASPMX.L.GOOGLE.COM [142.251.4.26] X=TLS1.2:ECDHE-ECDSA-AES128-GCM-SHA256:128 CV=yes C="250 2.0.0 OK 1631294373 c17si222990uav.133 - gsmtp"
2021-09-10 13:19:33 1mOkBY-0008WK-7o Completed
# From client to my server - it's fine
2021-09-10 13:19:36 1mOkBc-00005f-Kb <= [email protected] H=redacted.telus.net (DESKTOP5819TRQ) [50.99.XX.XXX] P=esmtpsa X=TLS1.2:ECDHE-ECDSA-AES128-GCM-SHA256:128 CV=no A=login:[email protected] S=8568 [email protected] T="RE: New promotion from www.gets.com :15%off" from <[email protected]> for [email protected]
# From server to other server - it's fine
2021-09-10 13:19:37 1mOkBc-00005f-Kb => [email protected] F=<[email protected]> R=lookuphost T=remote_smtp S=9670 H=ASPMX.L.GOOGLE.COM [142.251.4.26] X=TLS1.2:ECDHE-ECDSA-AES128-GCM-SHA256:128 CV=yes C="250 2.0.0 OK 1631294377 r189si6098021wmr.120 - gsmtp"
2021-09-10 13:19:37 1mOkBc-00005f-Kb Completed
# Daily limit hit - now the email address is half-mutated
2021-09-10 13:32:27 1mOkAd-0008T1-9r failed to expand condition "${perl{check_limits}}" for lookuphost router: Your E-Mail ([email protected]) has reached it's daily email limit of 50 emails
2021-09-10 13:32:28 1mOkAd-0008T1-9r => adam <[email protected]> F=<[email protected]> R=spamcheck_director T=spamcheck S=8836
2021-09-10 13:32:28 1mOkAd-0008T1-9r Completed
# Internal delivery - from them to me instead of them to the other recipient
2021-09-10 13:32:28 1mOkO3-0000kd-Eo <= [email protected] U=mail P=spam-scanned S=8957 [email protected] T="RE: New promotion from www.gets.com :15%off" from <[email protected]> for [email protected]
2021-09-10 13:32:28 1mOkO3-0000kd-Eo => adam <[email protected]> F=<[email protected]> R=virtual_user T=dovecot_lmtp_udp S=9306 C="250 2.0.0 <[email protected]> kOaHGqyWO2G/PgAAU/2IVg Saved"
2021-09-10 13:32:28 1mOkO3-0000kd-Eo CompletedHas anyone else seen this?
Version: DirectAdmin v.1.62.7
Stock exim.conf
Exim: 4.94.2
exim.conf update: yes, release 4.5