On Friday, October 9th, 2026 at 12:47 PM, Matus UHLAR - fantomas <[email protected]> wrote:
> >> >>>>> I got a spam from mout-xforward.gmx.net and was surprised that > >> >>>>> sending > >> >>>>> IP was widely blacklisted including by Spamhaus. Is "mout-xforward" a > >> >>>>> separate service that has a big outgoing spam problem? > >> >>>> > >> >>>> mout-xforward.gmx.net is used, if the user has a forwarding enabled > >> >>>> and > >> >>>> GMX has tagged the mail as SPAM. > >> >>> > >> >>> Forwarding to the user? > >> >>> So, only GMX users should get mail from mout-xforward.gmx.net? > >> >> > >> >> No, forwarding from GMX users to external addresses. > >> > > >> > External address belonging to a GMX user? > >> > Else I don't understand what forwarding is talked about. > > >On Thursday, October 8th, 2026 at 7:19 AM, Andrew C Aitchison > ><[email protected]> wrote: > >> Whatever address (addresses?) the GMX user requested. > >> > >> I don't see how a spammer could use it to send bulk email, > >> but some will come through the normal servers and thus have > >> a better reputation. > >> > >> Were dkim and spf marked as from GMX or the original sender ? > > On 08.10.26 17:34, ndrs via mailop wrote: > >DKIM marked for the original domain (not GMX), from header for the original > >domain, envelope sender for gmx.net > > So SPF passed. I assume, without modifications to headers DKIM passed too > and was aligned with From:, satisfying DMARC as well. GMX did everything > for their customer to deliver and for you to be able filter mail properly. > > I guess this is becoming more common. If a mail service can't block outgoing > susicious mail (forwarded or not), it uses separate outgoing mail server. > > This way, they send the mail, but don't risk their primary outgoing server > being marked as a spam source. > > Just filter such mail standard way, the secondary outgoing mail server > should result into higher spam score. > > It's probably bulk mail sent to GMX customers, not a way to abuse GMX to > send spam. Except that it was addressed to a address here that has no relationship with any GMX accounts. I've seen a couple more of these in the days since. Someone found a way to send junk through there to randomly selected victims (seems likely that its not targeted by manually entering a new forwarding address every time, unless maybe they found a way to automate it). Thanks to responses on this thread so I know I can add some points to that source by default. _______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
