I got some spam yesterday and what bothers me is that it looks like our own server sent it?
Received: from 43.Red-83-43-13.pooles.rima-tde.net [83.43.13.43] by PINE.MATROSITY.COM (SMTPD32-8.14) id A93E19B400A4; Sat, 09 Apr 2005 17:29:34 -0400
Received: from (65.112.155.254) (port=9021 helo=mLtXpFwGhP) by mx4.bsiws.bls.com with smtp id 163845c4d3c0$2180fea0$855aa5 for [EMAIL PROTECTED]; Sat, 09 Apr 2005 14:29:43 -0800
The first Received: header is the one your mailserver added. It says that IMail got the E-mail from 83.43.13.43, which claimed to be 43.Red-83-43-13.pooles.rima-tde.net (and really is, per a reverse DNS lookup).
However, any Received: headers after the first one are only trustable if you have a specific reason to trust them (normally if the first Received: header has an IP that you know is a legitimate mailserver, such as a Hotmail mailserver). So the question now becomes, do you trust 83.43.13.43, a dialup IP in Spain that is sending you spam? If not, the second Received: header can be assumed to be forged.
Of course, any sign that your server may be sending spam should not be taken lightly. If this is the only indication that your server may be sending spam, it can probably be ignored. In this case, the second Received: header claims that it is from a server named mx4.bsiws.bls.com -- but an A record lookup of that hostname shows that it does not exist. And, that Received: header claims that the HELO your server sent was "mLtXpFwGhP", which IMail won't send. It *could* be a trojan, but that is very unlikely, and given that the Received: header is almost certainly forged, I wouldn't be concerned unless there is another sign that there could be a problem.
-Scott
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
