[SOLVED] odd email? sending without Authentication

killmasta93

Renowned Member
Aug 13, 2017
974
59
68
31
Hi,
I was wondering if someone else has had this issue before, currently a user reported that they got an email from admin@mydomain.com which is impossible i checked on the tracking center does it appear, checked the headers of the email it shows that they used the port 25 to send me an email dirrectly, which is very odd because i have it blocked @mydomain.com cannot enter though proxmox because all my emails internally do not pass by the filter.

Code:
Return-Path: <admin@mydomain.com>
Received: from mail.mydomain.com (LHLO mail.mydomain.com)
 (192.168.3.170) by mail.mydomain.com with LMTP; Wed, 14 Apr 2021
 15:09:55 -0500 (COT)
Received: from mail.localdomain.com.co (unknown [192.168.3.169])
    by mail.mydomain.com (Postfix) with ESMTPS id B598A36B10B5
    for <ha@mydomain.com>; Wed, 14 Apr 2021 15:09:55 -0500 (-05)
Received: from mail.localdomain.com.co (localhost.localdomain [127.0.0.1])
    by mail.localdomain.com.co (Proxmox) with ESMTP id 97DBB3C18D7
    for <ha@mydomain.com>; Wed, 14 Apr 2021 15:09:55 -0500 (-05)
Received-SPF: none (mydomain.com: No applicable sender policy available) receiver=mail.localdomain.com.co; identity=mailfrom; envelope-from="admin@mydomain.com"; helo=mail.jrb.co.rs; client-ip=194.247.206.37
Received: from mail.jrb.co.rs (mail.jrb.co.rs [194.247.206.37])
    by mail.localdomain.com.co (Proxmox) with ESMTP id 1BDCD3C18D5
    for <ha@mydomain.com>; Wed, 14 Apr 2021 15:09:51 -0500 (-05)
Received: from localhost (localhost [127.0.0.1])
    by mail.jrb.co.rs (Postfix) with ESMTP id 46E711CA9570
    for <ha@mydomain.com>; Wed, 14 Apr 2021 20:33:06 +0200 (CEST)
Received: from mail.jrb.co.rs ([127.0.0.1])
    by localhost (mail.jrb.co.rs [127.0.0.1]) (amavisd-new, port 10032)
    with ESMTP id wYliCQbfYZOT; Wed, 14 Apr 2021 20:33:05 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
    by mail.jrb.co.rs (Postfix) with ESMTP id 12D691CAC5CB;
    Wed, 14 Apr 2021 19:21:41 +0200 (CEST)
X-Virus-Scanned: amavisd-new at mail.jrb.co.rs
Received: from mail.jrb.co.rs ([127.0.0.1])
    by localhost (mail.jrb.co.rs [127.0.0.1]) (amavisd-new, port 10026)
    with ESMTP id Z5Yl8WdtCyWv; Wed, 14 Apr 2021 19:21:40 +0200 (CEST)
Received: from gmavt.net (unknown [185.244.38.80])
    by mail.jrb.co.rs (Postfix) with ESMTPSA id F3C491CAAF31
    for <ha@mydomain.com>; Wed, 14 Apr 2021 17:04:42 +0200 (CEST)
From: mydomain.com  Admin <admin@mydomain.com>
To: ha@mydomain.com
Subject: =?UTF-8?B?UGFzc3dvcmQgwqBSZXNldCBmb3Ig?=ha@mydomain.com
Date: 14 Apr 2021 17:04:43 +0200
Message-ID: <20210414170443.CE82A881516808E0@mydomain.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
    boundary="----=_NextPart_000_0012_90917D8E.E3D3BE51"

This is a multi-part message in MIME format.

Thank you
 
The headers show (unless modified) that the mail was received from mail.jrb.co.rs (mail.jrb.co.rs [194.247.206.37]) with a SMTP-envelope from of admin@mydomain.com - so that would confirm what you're seeing in the tracking center...
which is very odd because i have it blocked @mydomain.com cannot enter though proxmox
how did you block mails from @mydomain.com entering through proxmox?


keep in mind that faking smtp-envelope (and also header) from is usually easily possible.
 
The headers show (unless modified) that the mail was received from mail.jrb.co.rs (mail.jrb.co.rs [194.247.206.37]) with a SMTP-envelope from of admin@mydomain.com - so that would confirm what you're seeing in the tracking center...

how did you block mails from @mydomain.com entering through proxmox?


keep in mind that faking smtp-envelope (and also header) from is usually easily possible.
thanks for the reply, i created a rule to block all @mydomain.com because all the emails internally do not pass though proxmox so i avoid that fake email going though but i saw what happened had the rules in the wrong order which solved that issue
 
  • Like
Reactions: Stoiko Ivanov