How to stop this?

[Chris Arnold]

Hello list. Forgive me if this has been addressed before. I get email that is addressed to a user that is not even a user on the mail server or domain. We use zimbra 6 OSS which has builtin spamassassin and uses postfix. Here is a copy of the headers (with specific stuff changed or cut out):
Return-Path: negro2078@...
Received: from mail.server.com (LHLO mail.server.com)
 (ip.of.server) by mail.server.com with LMTP; Fri, 6 Nov 2009
 17:20:34 -0500 (EST)
Received: from localhost (localhost [127.0.0.1])
    by mail.server.com (Postfix) with ESMTP id D732ABFF51
    for <myemail@...>; Fri,  6 Nov 2009 17:20:33 -0500 (EST)
X-Virus-Scanned: amavisd-new at mail.server.com
X-Spam-Flag: NO
X-Spam-Score: 2.346
X-Spam-Level: **
X-Spam-Status: No, score=2.346 tagged_above=-10 required=6.6
    tests=[BAYES_05=-1.11, HTML_MESSAGE=0.001, URIBL_BLACK=1.955,
    URIBL_OB_SURBL=1.5] autolearn=no
Received: from mail.server.com ([127.0.0.1])
    by localhost ( mail.server.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id WTkUevQdagxY for <myemail@...>;
    Fri,  6 Nov 2009 17:20:29 -0500 (EST)
Received: from cdptpa-imtalb.mail.rr.com (cdptpa-imtalb.mail.rr.com [75.180.132.34])
    by mail.server.com (Postfix) with ESMTP id ED71CBFE1E
    for <myemail@...>; Fri,  6 Nov 2009 17:20:28 -0500 (EST)
Received: from cdptpa-mxlb.mail.rr.com ([10.127.255.82])
          by cdptpa-imta07.mail.rr.com with ESMTP
          id <20091106222028261.ETSN29511@...>
          for <myemail@...>; Fri, 6 Nov 2009 22:20:28 +0000
X-TWC-Junkmail-Folder: true
X-Cloudmark-Score: 100
X-RR-Connecting-IP: 65.55.116.107
X-Authority-Analysis: v=1.0 c=0 p=-ecq8t7vAAAA:8 a=yxkcr7uzOwoA:10
Received: from [65.55.116.107] ([65.55.116.107:3802] helo=blu0-omc3-s32.blu0.hotmail.com)
    by cdptpa-iedge02.mail.rr.com (envelope-from <negro2078@...>)
    (ecelerity 2.2.2.39 r()) with ESMTP
    id 9E/E5-02065-C21A4FA4; Fri, 06 Nov 2009 22:20:28 +0000
Received: from BLU145-W5 ([65.55.116.74]) by blu0-omc3-s32.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
     Fri, 6 Nov 2009 14:20:25 -0800
Message-ID: <BLU145-W591D2343383238C3F8857B3AF0@...>
Content-Type: multipart/alternative;
    boundary="_32294ce2-9381-41a6-9a48-aef515301452_"
X-Originating-IP: [113.66.28.156]
From: =?iso-8859-1?B?QU5UT05JTyBKT1PJIGZsb3JlcyBjYXJtb25h?=
    <negro2078@...>
To: <carnold@...>
Subject: RE # Business
Date: Fri, 6 Nov 2009 22:20:25 +0000
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 06 Nov 2009 22:20:25.0915 (UTC) FILETIME=[56E0B8B0:01CA5F2F]

Is it possible to stop this?

[Chris Arnold]

Sent from my iPhone

On Nov 6, 2009, at 9:45 PM, Evan Platt <evan@...> wrote:

> At 06:23 PM 11/6/2009, you wrote:
>> Hello list. Forgive me if this has been addressed before. I get  
>> email that is addressed to a user that is not even a user on the  
>> mail server or domain. We use zimbra 6 OSS which has builtin  
>> spamassassin and uses postfix. Here is a copy of the headers (with  
>> specific stuff changed or cut out):
>
> Please don't post to the list in HTML.
Sorry about the HTML
>
> Simple answer: If the e-mail truly is addressed to a user not on the  
> system, why are you accepting the mail?
Isn't that my question? Sounds like you are answering my question with  
my question.
>

[John Rudd]

On Fri, Nov 6, 2009 at 19:49, Chris Arnold <carnold@...> wrote:
>
>> Simple answer: If the e-mail truly is addressed to a user not on the
>> system, why are you accepting the mail?
>
> Isn't that my question? Sounds like you are answering my question with my
> question.

Perhaps, but "not accepting the mail" is an MTA issue, not an
SpamAssassin issue.

You need to configure Zimbra not to accept email for non-existent
users.  That's a question for the Zimbra folks, not the SpamAssassin
folks.

[Chris Arnold]

Sent from my iPhone

On Nov 6, 2009, at 10:59 PM, John Rudd <jrudd@...> wrote:

> On Fri, Nov 6, 2009 at 19:49, Chris Arnold <carnold@...
> > wrote:
>>
>>> Simple answer: If the e-mail truly is addressed to a user not on the
>>> system, why are you accepting the mail?
>>
>> Isn't that my question? Sounds like you are answering my question  
>> with my
>> question.
>
> Perhaps, but "not accepting the mail" is an MTA issue, not an
> SpamAssassin issue.
>
> You need to configure Zimbra not to accept email for non-existent
> users.  That's a question for the Zimbra folks, not the SpamAssassin
> folks.

I see. Thank you.

[David B Funk]

Chris,
Do you understand that email has two different sets of recipient (To)
addresses?
One is the in the header "To:" (in your example
"To: <carnold@...>") the other is called the envelope
recipient which shows up in your mail server logs and -may- also
be embedded in the "Received:" headers (in your example its the
"for <myemail@...>;" bit).

The header "To:" address is just window dressing, does not play any part
in SMTP mail routing, and could be almost anything.

The envelope recipient is used during the SMTP transactions and controls
the mail routing and delivery. It -must- correspond to a valid
user or recipient on your mail system. Most correctly configured MTA
systems will only let a message in the front-door if it contains a valid
envelope recipient address.

If that address "myemail@..." does not correspond to a valid
recipient on your mail system then you need to look into the zimbra
(postifx) configuration to see how to fix that.

If your concern is that that "To:" address does not correspond to a valid
recipient on your system then you're misunderstanding how email works.
Please search the archives of this list for a long-winded thread on
exactly this issue (header "To" not matching envelope recipient).

Dave

On Fri, 6 Nov 2009, Chris Arnold wrote:

> Hello list. Forgive me if this has been addressed before. I get email that
> is addressed to a user that is not even a user on the mail server or domain.
> We use zimbra 6 OSS which has builtin spamassassin and uses postfix. Here is
> a copy of the headers (with specific stuff changed or cut out):
>
> Return-Path: negro2078@...
> Received: from mail.server.com (LHLO mail.server.com)
>  (ip.of.server) by mail.server.com with LMTP; Fri, 6 Nov 2009
>  17:20:34 -0500 (EST)
> Received: from localhost (localhost [127.0.0.1])
>     by mail.server.com (Postfix) with ESMTP id D732ABFF51
>     for <myemail@...>; Fri,  6 Nov 2009 17:20:33 -0500 (EST)
> X-Virus-Scanned: amavisd-new at mail.server.com
> X-Spam-Flag: NO
> X-Spam-Score: 2.346
> X-Spam-Level: **
> X-Spam-Status: No, score=2.346 tagged_above=-10 required=6.6
>     tests=[BAYES_05=-1.11, HTML_MESSAGE=0.001, URIBL_BLACK=1.955,
>     URIBL_OB_SURBL=1.5] autolearn=no
> Received: from mail.server.com ([127.0.0.1])
>     by localhost ( mail.server.com [127.0.0.1]) (amavisd-new, port 10024)
>     with ESMTP id WTkUevQdagxY for <myemail@...>;
>     Fri,  6 Nov 2009 17:20:29 -0500 (EST)
> Received: from cdptpa-imtalb.mail.rr.com (cdptpa-imtalb.mail.rr.com
> [75.180.132.34])
>     by mail.server.com (Postfix) with ESMTP id ED71CBFE1E
>     for <myemail@...>; Fri,  6 Nov 2009 17:20:28 -0500 (EST)
> Received: from cdptpa-mxlb.mail.rr.com ([10.127.255.82])
>           by cdptpa-imta07.mail.rr.com with ESMTP
>           id <20091106222028261.ETSN29511@...>
>           for <myemail@...>; Fri, 6 Nov 2009 22:20:28 +0000

[snip..]
> X-Originating-IP: [113.66.28.156]
> From: =?iso-8859-1?B?QU5UT05JTyBKT1PJIGZsb3JlcyBjYXJtb25h?=
>     <negro2078@...>
> To: <carnold@...>
> Subject: RE # Business
> Date: Fri, 6 Nov 2009 22:20:25 +0000
>
> Is it possible to stop this?

--
Dave Funk                                  University of Iowa
<dbfunk (at) engineering.uiowa.edu>        College of Engineering
319/335-5751   FAX: [phone]           1256 Seamans Center
Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{