"For:" e-mail address is different to "to:" e-mail address

[liviu]

Hi,

I have e weird problem and I would appreciate some help:

Env: Proxmox Mail Gateway 8.1.2 - community subscription.

We received a spam email, which landed on the address: hostmaster@our-domain.ro, without being caught by our PMG. At further investigation I can see that the spam score is zero and also it is addressed to different email address: office@smartproiect.ro, smartproiect.ro it is NOT our domain.
I don't understand why this email was not caught by the gateway.

Also the message has a .tar attachment which clearly is malicious.

I'm attaching also the email source. I replaced our real domain with "our-domain.ro"

Please if someone could explain why this happens and how can we prevent this from appearing in the future.

Thank you

Liviu

 

[dcsapak]

can you post the mail logs of the mail? e.g. from the tracking center

 

[liviu]

Hi

Attached

 

[dcsapak]

ok while it is unusual, it's not really forbidden in e-mails

there is the 'RCPT TO' in the smtp dialog from which the mail server deduces to which mailbox the mail should be sent
and there is the 'To' header in the mail which is not looked at from the mail server only the mail client

so the sender can send a mail with RCPT TO: hostmaster@something but have a office@something in the To header

as to why the mail was not detected as spam is because it obviously had nothing that spamassassin would detect as spam
the only thing noticeable is the 'T_SPF_HELO_TEMPERROR 0.01 SPF: test of HELO record failed (temperror) '

that could indicate a DNS problem on your pmg

 

[liviu]

Hi @dcsapak ,

Thanks for the explanation.

Best