Reject email (spam) when from address IP not match mail server IP

March 03, 2021 17:30

Hey there! It's interesting that you say the messages are fully authenticated. Could you post the mail headers here, just removing any public details like domains or IPs?

0

Ashtor

March 03, 2021 17:54

Here it is:

Received-SPF: pass (google.com: domain of hello@{{*privacy* MY_ADDON_DOMAIN}} designates {{*privacy* MY_WHM_IP}} as permitted sender) client-ip={{*privacy* MY_WHM_IP}};
{{** Here is -> foreign hostname/IP **}}
Received: by pixelstar.hu (Postfix, from userid 33) id 8989023F98A; Wed,
  3 Mar 2021 19:36:03 +0100 (CET)
To: "hello@{{*privacy* MY_ADDON_DOMAIN}}" 
Subject: DKIM teszt 4876
Date: Wed, 3 Mar 2021 19:36:03 +0100
From: "hello@{{*privacy* MY_ADDON_DOMAIN}}" 
Message-ID: <5b1265bd88dd11e72f08a64bd2b9f22d@www.vevovelemeny.hu>
{{** E-mail sent from foreign domain name **}}
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="b1_5b1265bd88dd11e72f08a64bd2b9f22d"
Content-Transfer-Encoding: 8bit
X-Spam-Status: No, score=2.0
X-Spam-Score: 20
X-Spam-Bar: ++
X-Ham-Report: Spam detection software, running on the system "{{*privacy* MY_WHM_HOST}}", has NOT identified this incoming email as spam.
  The original message has been attached to this so you can view it or label similar future email.
  If you have any questions, see root\@localhost for details. Content preview:
  Kedves C"mzett,K"r"s"re hamarosan v"laszolunkFelado:
   hello@{{*privacy* MY_ADDON_DOMAIN}} Kedves C"mzett, K"r"s"re hamarosan v"laszolunk
     Content analysis details:
   (2.0 points, 5.0 required)
  pts rule name
              description ---- ---------------------- --------------------------------------------------
  1.5 SPF_SOFTFAIL
           SPF: sender does not match SPF record (softfail)
  0.0 HTML_MESSAGE
           BODY: HTML included in message
  0.5 KAM_NUMSUBJECT
         Subject ends in numbers excluding current years
X-Spam-Flag: NO
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - {{*privacy* MY_WHM_HOST}}
X-AntiAbuse: Original Domain - {{*privacy* MY_ADDON_DOMAIN}}
X-AntiAbuse: Originator/Caller UID/GID - [xx xx] / [xx xx]
X-AntiAbuse: Sender Address Domain - {{*privacy* MY_ADDON_DOMAIN}}
X-Get-Message-Sender-Via: {{*privacy* MY_WHM_HOST}}: redirect/forwarder owner hello@{{*privacy* MY_ADDON_DOMAIN}} -> {{*privacy* MY_GMAIL}}
X-Authenticated-Sender: {{*privacy* MY_WHM_HOST}}: hello@{{*privacy* MY_ADDON_DOMAIN}}

0

cPRex Jurassic Moderator

March 03, 2021 18:58

Thanks for those details - this is the part that concerns me from those headers: Received: from {{*privacy* MY_WHM_HOST}} ({{*privacy* MY_WHM_HOST}}. [{{*privacy* MY_WHM_IP}}])
Since the return path shows your WHM server's IP address, that seems to indicate the message was sent from your server. Do you see any evidence of this message coming outbound from your machine in the /var/log/exim_mainlog file?

0

Ashtor

March 03, 2021 22:32

Logs (new):

2021-03-04 00:27:35 1lHatx-0004JO-PI H=srv2.pixelstar.hu (pixelstar.hu) [185.43.207.238]:55996 Warning: "SpamAssassin as vj detected message as NOT spam (2.0)"
2021-03-04 00:27:35 1lHatx-0004JO-PI <= hello@{{*privacy* MY_WHM_HOST}} H=srv2.pixelstar.hu (pixelstar.hu) [185.43.207.238]:55996 P=esmtp S=2219 id=560e80edf61f7fcd2a419d9eab88ca2a@www.vevovelemeny.hu T="DKIM teszt 9156" for hello@{{*privacy* MY_WHM_HOST}}
2021-03-04 00:27:35 SMTP connection from srv2.pixelstar.hu (pixelstar.hu) [185.43.207.238]:55996 closed by QUIT
2021-03-04 00:27:35 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1lHatx-0004JO-PI
2021-03-04 00:27:35 1lHatx-0004JO-PI SMTP connection identification D={{*privacy* MY_WHM_HOST}} O=hello@{{*privacy* MY_WHM_HOST}} E={{*privacy* MY_GMAIL}} M=1lHatx-0004JO-PI U=XXX ID=XXXX B=redirect_resolver
2021-03-04 00:27:35 1lHatx-0004JO-PI Sender identification U=XXX D={{*privacy* MY_WHM_HOST}} S=hello@{{*privacy* MY_WHM_HOST}}
2021-03-04 00:27:35 1lHatx-0004JO-PI SMTP connection outbound 1614814055 1lHatx-0004JO-PI {{*privacy* MY_WHM_HOST}} {{*privacy* MY_GMAIL}}
2021-03-04 00:27:36 1lHatx-0004JO-PI => {{*privacy* MY_GMAIL}} (hello@{{*privacy* MY_WHM_HOST}})  R=dkim_lookuphost T=dkim_remote_smtp H=gmail-smtp-in.l.google.com [108.177.127.27] X=TLS1.2:ECDHE-ECDSA-AES128-GCM-SHA256:128 CV=yes C="250 2.0.0 OK  1614814056 p9si7439902edh.186 - gsmtp"
2021-03-04 00:27:36 1lHatx-0004JO-PI Completed

0

cPRex Jurassic Moderator

March 03, 2021 22:50

Thanks for that information. It might be a good idea to work through the information on this page to see if you can get even more information:

0

Ashtor

March 04, 2021 05:34

How to setup exim to reject this emails?

0

cPRex Jurassic Moderator

March 04, 2021 14:01

If there was an easy way to block all spoofed messages, we would have included that directly in the product by default, but unfortunately there just isn't. Were you able to confirm if the message was indeed originating from your server as spam? If not, it would be good to confirm that first, and you're always welcome to open a support ticket with our team so we can examine the system directly.

0

Ashtor

March 04, 2021 15:07

Scrammer says: "I sent you an email from your account ... I hacked your system... pay me bitcoin... etc etc". Like those:

0

Ashtor

March 04, 2021 15:18

The solution sounds easy to me: IF the sender address is one of my domains -> Check sender's IP address. -> IF it's different from my IP, THAN reject / stop forwarding.

0

cPRex Jurassic Moderator

March 04, 2021 15:53

I still believe it would be best for you to open a ticket with our team. Since you have root access we could check the settings on the server for you and ensure things are secure.

0

BITCOINTIDINGS

December 27, 2021 19:00

I am interested in whether the above problem has been solved and whether an error has been found that caused taking control of access to the mail? This is very important. Regards

0

cPanelAnthony

December 28, 2021 20:45

I am interested in whether the above problem has been solved and whether an error has been found that caused taking control of access to the mail? This is very important. Regards

Hello! No ticket was opened for this issue. You can certainly open one using the link in my signature and we can investigate. If you do so, please provide me with the ticket ID.

0

BITCOINTIDINGS

December 30, 2021 12:21

Hello! I am asking if the above case has been resolved. If there were third parties there, it means that anyone could have such a problem, sooner or later.

0

cPanelAnthony

December 30, 2021 21:09

Hello! I am asking if the above case has been resolved. If there were third parties there, it means that anyone could have such a problem, sooner or later.

Emails being spoofed, etc... Is just something that can happen with email in general. The way email is authenticated and sent has to do with Exim; it isn't something cPanel would have control over. Maybe I am misunderstanding you. Can you elaborate in detail regarding what you believe cPanel should provide a fix for specifically? My suggestion would be to write up the full suggestion as detailed as possible and then submit a feature request using the link in my signature. If you do open a feature request, please post it here so we can get some support for it.

0

Reject email (spam) when from address IP not match mail server IP

Comments

Didn't find what you were looking for?