>If you use "Relay for Addresses" (which is one of the only two safe >options;
That's how I have it. >spammers should only be able to relay mail if they come from one of >the "safe" IPs that you allow My guess is this is what's happening...? >You're not looking in the right place. :) Figured as much... The "SMTP" (or "SMTP-") lines are where your mailserver is sending mail to another. In this case, you've sent a command (most likely "EHLO"), and they are responding to you. They can send whatever they want in their response, and several mailservers will include your reverse DNS entry. >>This portion: adsl-210-151.tricom.net [200.42.210.151] is the reverse >>lookup record of my MX record, mailtest.enelpunto.net. My question is: >>how is a spammer able to put that in the commands? >They aren't -- if one of the two mailservers is sending spam in this case, >it's yours -- because you are sending mail to them. You connected to their >server. Hmm...doesn't sound good. >>Or, is this a completely legitimate line and I just don't understand >>the SMTP process well enough yet??? >:) >It takes a while to understand SMTP transactions and the IMail logs. All things come to those who wait......I hope! >What you want to look for is only lines that have "SMTPD" in them (which >indicates E-mail that IMail is receiving). Here are a bunch of lines: 20020920 042112 127.0.0.1 SMTP (848) processing d:\IMail\spool\Qda6e02a60048319f.SMD 20020920 042113 127.0.0.1 SMTPD (02A60048) [172.20.207.185] MAIL From: <[EMAIL PROTECTED]> 20020920 042114 127.0.0.1 SMTPD (02A60048) [172.20.207.185] RCPT To:<[EMAIL PROTECTED]> 20020920 042114 127.0.0.1 SMTPD (02A60048) [172.20.207.185] RCPT To:<[EMAIL PROTECTED]> 20020920 042115 127.0.0.1 SMTPD (02A60048) [172.20.207.185] RCPT To:<[EMAIL PROTECTED]> 20020920 042116 127.0.0.1 SMTPD (02A60048) [172.20.207.185] RCPT To:<[EMAIL PROTECTED]> 20020920 042117 127.0.0.1 SMTPD (02A60048) [172.20.207.185] max RCPT exceeded RCPT To:<[EMAIL PROTECTED]> 20020920 042117 127.0.0.1 SMTP (848) ldeliver almagapa.com vja-main (1) [EMAIL PROTECTED] 7449 20020920 042117 127.0.0.1 SMTP (848) Trying yahoo.com (0) 20020920 042117 127.0.0.1 SMTPD (02A60048) [172.20.207.185] max RCPT exceeded RCPT To:<[EMAIL PROTECTED]> I've got max messages set to 5 as a way to try and slow this down a bit... V�ctor --- Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for IMail. http://www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ Disclaimer_BNCINCMAIL_In Disclaimer_BNCEXTMAIL_Out To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
