E-Mail vom PMG im Auftrag von...

TheBit

TheBit

Member
Oct 26, 2021
17
1
8
41
Berlin
Hallo,

kann mir jemand erklären, wie so eine Mail möglich ist. WIeso kann jemand als PMG eine Mail versenden an mich?

1689061830916.png

Danke, Grüße
 
Bitte die logs vom PMG zu dieser mail posten - dann lässt sich vielleicht etwas finden.
 
Jul 10 12:24:34 pmg2 postfix/postscreen[853379]: PASS OLD [185.255.131.40]:40974
Jul 10 12:24:34 pmg2 postfix/smtpd[857164]: connect from postal.ninjaemail.cloud[185.255.131.40]
Jul 10 12:24:34 pmg2 pmgpolicy[856885]: SPF says pass
Jul 10 12:24:34 pmg2 postfix/smtpd[857164]: D61C62113D: client=postal.ninjaemail.cloud[185.255.131.40]
Jul 10 12:24:34 pmg2 postfix/cleanup[857168]: D61C62113D: message-id=<bef5e7fe-5740-46ec-b636-39b868f97289@rp.postal.ninjaemail.cloud>
Jul 10 12:24:34 pmg2 postfix/qmgr[641012]: D61C62113D: from=<lpekch@psrp.funfsterne.de>, size=22892, nrcpt=1 (queue active)
Jul 10 12:24:34 pmg2 pmg-smtp-filter[856953]: 2023/07/10-12:24:34 CONNECT TCP Peer: "[127.0.0.1]:49500" Local: "[127.0.0.1]:10024"
Jul 10 12:24:34 pmg2 pmg-smtp-filter[856953]: 2133A64ABDC62E5FAD: new mail message-id=<bef5e7fe-5740-46ec-b636-39b868f97289@rp.postal.ninjaemail.cloud>#012
Jul 10 12:24:35 pmg2 postfix/smtpd[857164]: disconnect from postal.ninjaemail.cloud[185.255.131.40] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
Jul 10 12:24:35 pmg2 pmg-smtp-filter[856953]: 2133A64ABDC62E5FAD: SA score=1/5 time=0.648 bayes=undefined autolearn=disabled hits=DKIM_INVALID(0.1),DKIM_SIGNED(0.1),DMARC_PASS(-0.1),HTML_FONT_LOW_CONTRAST(0.001),HTML_MESSAGE(0.001),KAM_DMAR
C_STATUS(0.01),KAM_TRACKIMAGE(0.2),MIME_HTML_ONLY(0.1),MPART_ALT_DIFF(0.724),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),T_REMOTE_IMAGE(0.01),T_SCC_BODY_TEXT_LINE(-0.01)
Jul 10 12:24:35 pmg2 postfix/smtpd[857179]: connect from localhost.localdomain[127.0.0.1]
Jul 10 12:24:35 pmg2 postfix/smtpd[857179]: 9D6D12135B: client=localhost.localdomain[127.0.0.1], orig_client=postal.ninjaemail.cloud[185.255.131.40]
Jul 10 12:24:35 pmg2 postfix/cleanup[857168]: 9D6D12135B: message-id=<bef5e7fe-5740-46ec-b636-39b868f97289@rp.postal.ninjaemail.cloud>
Jul 10 12:24:35 pmg2 postfix/cleanup[857168]: 9D6D12135B: resent-message-id=<20230710102435.9D6D12135B@pmg2.xxx.de>
Jul 10 12:24:35 pmg2 postfix/qmgr[641012]: 9D6D12135B: from=<lpekch@psrp.funfsterne.de>, size=24208, nrcpt=1 (queue active)
Jul 10 12:24:35 pmg2 postfix/smtpd[857179]: disconnect from localhost.localdomain[127.0.0.1] ehlo=1 xforward=1 mail=1 rcpt=1 data=1 commands=5
Jul 10 12:24:35 pmg2 pmg-smtp-filter[856953]: 2133A64ABDC62E5FAD: accept mail to <service@xxx.de> (9D6D12135B) (rule: default-accept)
Jul 10 12:24:35 pmg2 pmg-smtp-filter[856953]: 2133A64ABDC62E5FAD: processing time: 0.749 seconds (0.648, 0.035, 0)
Jul 10 12:24:35 pmg2 postfix/lmtp[857169]: D61C62113D: to=<service@xxx.de>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.9, delays=0.1/0/0.04/0.75, dsn=2.5.0, status=sent (250 2.5.0 OK (2133A64ABDC62E5FAD))
Jul 10 12:24:35 pmg2 postfix/qmgr[641012]: D61C62113D: removed
Jul 10 12:24:35 pmg2 postfix/smtp[857180]: 9D6D12135B: to=<service@xxx.de>, relay=mx10.xxx.de[x.x.x.x]:25, delay=0.24, delays=0.05/0/0.11/0.09, dsn=2.0.0, status=sent (250 Requested mail action okay, completed)
Jul 10 12:24:35 pmg2 postfix/qmgr[641012]: 9D6D12135B: removed
 
Last edited:
da scheint noch einiges zu fehlen - z.b. der Verbindungsaufbau vom ursprünglichen sender (postal.ninjaemail.cloud), und auch pmg-smtp-filter logs (wo uA auch die spam-hits beschrieben sein sollten...)
 
  • Like
Reactions: TheBit
da fällt jetzt mal nichts allzu sehr aus dem Rahmen ...

was seltsam ist, ist dass der mail-client (WebApp?) die envelope-address lpekch@psrp.funfsterne.de gar nicht auftaucht
bitte noch die gesamten header der mail posten (in code tags)
aber - ja header kann der absender beliebige hineinschreiben - wie sie angezeigt werden ist sache des mail-clients.
 
Evtl. ergänzt der PMG das, da Sender: FUNFSTERNE@pmg2.xxx.de übergeben wird?

Code: 
Return-Path: <lpekch@psrp.funfsterne.de>
Received: from mx10.xxx.de (127.0.0.1:55256)
    by mx10 (kopano-dagent) with LMTP;
    Tue, 11 Jul 2023 09:46:54 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
    by mx10.xxx.de (Postfix) with ESMTP id B8214BE572
    for <xxx@xxx.de>; Tue, 11 Jul 2023 09:46:54 +0200 (CEST)
X-Virus-Scanned: by amavisd-new-2.10.1 (20141025) (Debian) at xxx.de
X-Spam-Flag: NO
X-Spam-Score: -5.141
X-Spam-Level:
X-Spam-Status: No, score=-5.141 tagged_above=-1000 required=5
    tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1,
    HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1,
    MPART_ALT_DIFF=0.79, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001,
    SPF_SOFTFAIL=0.665, T_REMOTE_IMAGE=0.01, T_SCC_BODY_TEXT_LINE=-0.01,
    URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mx10.xxx.de ([127.0.0.1])
    by localhost (mx10.xxx.de [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id yi4yGZNaqEJ3 for <xxx@xxx.de>;
    Tue, 11 Jul 2023 09:46:54 +0200 (CEST)
Received: from pmg2.xxx.de (pmg2.xxx.de [xxx])
    by mx10.xxx.de (Postfix) with ESMTP id 4F68ABE571
    for <xxx@xxx.de>; Tue, 11 Jul 2023 09:46:54 +0200 (CEST)
Received: from pmg2.xxx.de (localhost.localdomain [127.0.0.1])
    by pmg2.xxx.de (Proxmox) with ESMTP id 26E7F21789
    for <xxx@xxx.de>; Tue, 11 Jul 2023 09:46:54 +0200 (CEST)
Received-SPF: pass (psrp.funfsterne.de: 185.255.131.40 is authorized to use 'lpekch@psrp.funfsterne.de' in 'mfrom' identity (mechanism 'a' matched)) receiver=pmg2.xxx.de; identity=mailfrom; envelope-from="lpekch@psrp.funfsterne.de"; helo=postal.ninjaemail.cloud; client-ip=185.255.131.40
Received: from postal.ninjaemail.cloud (postal.ninjaemail.cloud [185.255.131.40])
    by pmg2.xxx.de (Proxmox) with ESMTPS id 6E3B621613
    for <xxx@xxx.de>; Tue, 11 Jul 2023 09:46:53 +0200 (CEST)
Resent-Sender: lpekch@psrp.funfsterne.de
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=funfsterne.de;
    s=postal-uVHJaa; t=1689061613;
    bh=sYpb9sy47BM6hy9xwMjO12Uo/QrUVYw4hbv/uiSI86U=;
    h=date:from:sender:to:message-id:subject:mime-version:content-type:content-transfer-encoding;
    b=WAv2fBrbT2GVkDEFVW2uuHqanw7JzseYdA5mSA4clMJ49NSiwN0mntGLMn+eqJ5t/m6z6Xxe
    hMa5RTyjv69k7nbxDRs7noHyqDQSuS22r/h1p7qdBNyynxDtVc/SYrkIBFzOvA4PuUsImCOL
    5qUskEEaE/hb0626RS19gJi0Gqw=
X-Postal-MsgID: inZhtxZD1ygG
Received: from api (ec2-52-213-143-26.eu-west-1.compute.amazonaws.com [52.213.143.26]) by Postal with HTTP; Tue, 11 Jul 2023 07:46:52 +0000
Date: Tue, 11 Jul 2023 07:46:52 +0000
From: info@funfsterne.de
Sender: FUNFSTERNE@pmg2.xxx.de
To: xxx@xxx.de
Message-ID: <90b1f0a4-b30a-46f8-8a85-480c99ff868b@rp.postal.ninjaemail.cloud>
Subject: Positive Google Bewertungen
Mime-Version: 1.0
Content-Type: multipart/mixed;
 boundary="--==_mimepart_64ad08ecdffaf_8690019686103d";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
X-SPAM-LEVEL: Spam detection results:  1
    DKIM_INVALID              0.1 DKIM or DK signature exists, but is not valid
    DKIM_SIGNED               0.1 Message has a DKIM or DK signature, not necessarily valid
    DMARC_PASS               -0.1 DMARC pass policy
    HTML_FONT_LOW_CONTRAST  0.001 HTML font color similar or identical to background
    HTML_MESSAGE            0.001 HTML included in message
    KAM_DMARC_STATUS         0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
    KAM_TRACKIMAGE            0.2 Message has a remote image explicitly meant for tracking
    MIME_HTML_ONLY            0.1 Message only has text/html MIME parts
    MPART_ALT_DIFF          0.724 HTML and text parts are different
    SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
    SPF_PASS               -0.001 SPF: sender matches SPF record
    T_REMOTE_IMAGE           0.01 Message contains an external image
    T_SCC_BODY_TEXT_LINE    -0.01 -
Resent-Message-Id: <20230711074654.26E7F21789@pmg2.xxx.de>
Resent-Date: Tue, 11 Jul 2023 09:46:54 +0200 (CEST)
Resent-From: lpekch@psrp.funfsterne.de
 
TheBit said:
vtl. ergänzt der PMG das, da Sender: FUNFSTERNE@pmg2.xxx.de übergeben wird?
Click to expand...
Von Haus aus macht PMG das nicht - außer es ist eine dementsprechende Regel im Regelsystem angelegt (oder es wurde in der postfix config etwas verändert).

Ich würde eher davon ausgehen, dass die mail den Sender header in der Form schon hatte (und der Sender header sorgt dafuer, dass es im Mail client als '... im Auftrag von...' angezeigt wird
 
  • Like
Reactions: MarvinE
You must log in or register to reply here.
Top Bottom