On 02/02/2022 10.11, Syafril Hermansyah via Mdaemon-L wrote:
Perbaiki setting Antispam content filteringnya mengikuti tips berikut
Sekalian diupgrade versi MDaemon ke v21.5.1
Baik Pak
Bukan transkrip routing log, yang perlu saya lihat transkrip smtp-in
log dari spam mail tersebut.
Terlampir sample smtp log dari email tersebut pak
Wed 2022-02-02 08:25:48.244: 01: ----------
Wed 2022-02-02 08:25:47.866: 05: [21974619] Session 21974619; child 0002
Wed 2022-02-02 08:25:47.866: 05: [21974619] Accepting SMTP connection
from 218.188.222.2:55920 to 103.150.114.156:25
Wed 2022-02-02 08:25:47.866: 07: [21974619] Location Screen says
connection is from Hong Kong, Asia
Wed 2022-02-02 08:25:47.867: 03: [21974619] --> 220 mail.persada.id
ESMTP MDaemon 21.5.0; Wed, 02 Feb 2022 08:25:47 +0700
Wed 2022-02-02 08:25:47.922: 02: [21974619] <-- EHLO
avas.intranet.tsss.edu.hk
Wed 2022-02-02 08:25:47.922: 03: [21974619] --> 250-mail.persada.id
Hello avas.intranet.tsss.edu.hk [218.188.222.2], pleased to meet you
Wed 2022-02-02 08:25:47.922: 03: [21974619] --> 250-ETRN
Wed 2022-02-02 08:25:47.922: 07: [21974619] Location Screening hiding
AUTH from country Hong Kong, Asia
Wed 2022-02-02 08:25:47.922: 03: [21974619] --> 250-8BITMIME
Wed 2022-02-02 08:25:47.922: 03: [21974619] --> 250-ENHANCEDSTATUSCODES
Wed 2022-02-02 08:25:47.922: 03: [21974619] --> 250-PIPELINING
Wed 2022-02-02 08:25:47.922: 03: [21974619] --> 250-CHUNKING
Wed 2022-02-02 08:25:47.922: 03: [21974619] --> 250 SIZE
Wed 2022-02-02 08:25:47.975: 02: [21974619] <-- MAIL
FROM:<[email protected]> SIZE=2897
Wed 2022-02-02 08:25:47.987: 05: [21974619] Performing PTR lookup
(2.222.188.218.IN-ADDR.ARPA)
Wed 2022-02-02 08:25:47.991: 05: [21974619] *
D=2.222.188.218.IN-ADDR.ARPA TTL=(1406)
PTR=[static-bbs-2-222-188-218-on-nets.com]
Wed 2022-02-02 08:25:48.044: 05: [21974619] * No A/AAAA records found
Wed 2022-02-02 08:25:48.044: 05: [21974619] ---- End PTR results
Wed 2022-02-02 08:25:48.047: 05: [21974619] Performing IP lookup
(avas.intranet.tsss.edu.hk)
Wed 2022-02-02 08:25:48.566: 04: [21974619] * DNS server refuses to
honor queries from this location
Wed 2022-02-02 08:25:48.566: 05: [21974619] ---- End IP lookup results
Wed 2022-02-02 08:25:48.575: 05: [21974619] Performing IP lookup
(intranet.tsss.edu.hk)
Wed 2022-02-02 08:25:48.578: 05: [21974619] * D=intranet.tsss.edu.hk
TTL=(0) A=[218.188.222.4]
Wed 2022-02-02 08:25:48.581: 05: [21974619] * P=020 S=000
D=intranet.tsss.edu.hk TTL=(0) MX=[intranet.tsss.edu.hk]
Wed 2022-02-02 08:25:48.584: 05: [21974619] * D=intranet.tsss.edu.hk
TTL=(0) A=[218.188.222.4]
Wed 2022-02-02 08:25:48.585: 05: [21974619] ---- End IP lookup results
Wed 2022-02-02 08:25:48.585: 09: [21974619] Performing SPF lookup
(avas.intranet.tsss.edu.hk / 218.188.222.2)
Wed 2022-02-02 08:25:48.756: 09: [21974619] * Result: none; no SPF
record in DNS
Wed 2022-02-02 08:25:48.756: 09: [21974619] ---- End SPF results
Wed 2022-02-02 08:25:48.757: 09: [21974619] Performing SPF lookup
(intranet.tsss.edu.hk / 218.188.222.2)
Wed 2022-02-02 08:25:48.807: 09: [21974619] * Policy: v=spf1 a mx
ip4:218.188.222.2 ip4:218.188.222.4 include:spf.eclasscloud.hk ~all
Wed 2022-02-02 08:25:48.811: 09: [21974619] * Evaluating a: no match
Wed 2022-02-02 08:25:48.818: 09: [21974619] * Evaluating mx: no match
Wed 2022-02-02 08:25:48.818: 09: [21974619] * Evaluating
ip4:218.188.222.2: match
Wed 2022-02-02 08:25:48.818: 09: [21974619] * Result: pass
Wed 2022-02-02 08:25:48.818: 09: [21974619] ---- End SPF results
Wed 2022-02-02 08:25:48.818: 03: [21974619] --> 250 2.1.0 Sender OK
Wed 2022-02-02 08:25:48.818: 02: [21974619] <-- RCPT
TO:<[email protected]>
Wed 2022-02-02 08:25:48.854: 05: [21974619] Performing DNS-BL lookup
(218.188.222.2 - connecting IP)
Wed 2022-02-02 08:25:48.859: 05: [21974619] * zen.spamhaus.org - passed
Wed 2022-02-02 08:25:48.948: 05: [21974619] * bl.spamcop.net - passed
Wed 2022-02-02 08:25:48.948: 05: [21974619] ---- End DNS-BL results
Wed 2022-02-02 08:25:48.950: 03: [21974619] --> 250 2.1.5 Recipient OK
Wed 2022-02-02 08:25:48.950: 02: [21974619] <-- DATA
Wed 2022-02-02 08:25:48.953: 03: [21974619] --> 354 Enter mail, end with
<CRLF>.<CRLF>
Wed 2022-02-02 08:25:49.057: 01: [21974619] Message size: 2896 bytes
Wed 2022-02-02 08:25:49.058: 10: [21974619] Performing DKIM verification
Wed 2022-02-02 08:25:49.058: 10: [21974619] * File:
c:\mdaemon\queues\temp\md5001000003402.tmp
Wed 2022-02-02 08:25:49.058: 10: [21974619] * Message-ID:
<[email protected]>
Wed 2022-02-02 08:25:49.058: 10: [21974619] * Result: neutral
Wed 2022-02-02 08:25:49.058: 10: [21974619] ---- End DKIM results
Wed 2022-02-02 08:25:49.065: 19: [21974619] Performing DMARC processing
Wed 2022-02-02 08:25:49.065: 19: [21974619] * File:
c:\mdaemon\queues\temp\md5001000003402.tmp
Wed 2022-02-02 08:25:49.065: 19: [21974619] * Message-ID:
<[email protected]>
Wed 2022-02-02 08:25:49.065: 19: [21974619] * Author domain:
intranet.tsss.edu.hk
Wed 2022-02-02 08:25:49.065: 19: [21974619] * Organizational domain:
tsss.edu.hk
Wed 2022-02-02 08:25:49.065: 19: [21974619] * Query domain:
_dmarc.intranet.tsss.edu.hk
Wed 2022-02-02 08:25:49.805: 19: [21974619] * No DMARC policy record
found
Wed 2022-02-02 08:25:49.805: 19: [21974619] * Query domain:
_dmarc.tsss.edu.hk
Wed 2022-02-02 08:25:50.163: 19: [21974619] * No DMARC policy record
found
Wed 2022-02-02 08:25:50.163: 19: [21974619] * Action taken: none
Wed 2022-02-02 08:25:50.163: 19: [21974619] * Result: none
Wed 2022-02-02 08:25:50.163: 19: [21974619] ---- End DMARC results
Wed 2022-02-02 08:25:50.166: 06: [21974619] Passing message through
AntiVirus (Size: 2896)...
Wed 2022-02-02 08:25:50.203: 06: [21974619] * Message is clean (no
viruses found) scanned by (ClamAV)
Wed 2022-02-02 08:25:50.203: 06: [21974619] ---- End AntiVirus results
Wed 2022-02-02 08:25:50.240: 11: [21974619] Passing message through
Outbreak Protection...
Wed 2022-02-02 08:25:50.241: 11: [21974619] * Message-ID:
<[email protected]>
Wed 2022-02-02 08:25:50.241: 11: [21974619] * Reference-ID:
str=0001.0A67340D.61F9D6FC.0052,ss=3,sh,re=0.000,recu=0.000,reip=0.000,cl=3,cld=1,fgs=0
Wed 2022-02-02 08:25:50.241: 11: [21974619] * Virus result: 0 - Clean
Wed 2022-02-02 08:25:50.241: 11: [21974619] * Spam result: 3 - Spam (bulk)
Wed 2022-02-02 08:25:50.241: 11: [21974619] * IWF result: 0 - Clean
Wed 2022-02-02 08:25:50.241: 11: [21974619] ---- End Outbreak Protection
results
Wed 2022-02-02 08:25:50.243: 07: [21974619] Passing message through Spam
Filter (Size: 2896)...
Wed 2022-02-02 08:25:50.590: 07: [21974619] * 2.5 MDAEMON_OP_SPAM_HIGH
MDaemon: spam/phish
Wed 2022-02-02 08:25:50.590: 07: [21974619] * 0.5 PDS_BTC_ID FP reduced
Bitcoin ID
Wed 2022-02-02 08:25:50.590: 07: [21974619] * 0.4 KHOP_HELO_FCRDNS
Relay HELO differs from its IP's reverse DNS
Wed 2022-02-02 08:25:50.590: 07: [21974619] ---- End SpamAssassin results
Wed 2022-02-02 08:25:50.590: 07: [21974619] Spam Filter score/req: 3.40/12.0
Wed 2022-02-02 08:25:50.648: 01: [21974619] Message creation successful:
c:\mdaemon\queues\inbound\md5001002760856.msg
Wed 2022-02-02 08:25:50.648: 03: [21974619] --> 250 2.6.0 Ok, message
saved <Message-ID: <[email protected]>>
Wed 2022-02-02 08:25:50.648: 02: [21974619] <-- QUIT
Wed 2022-02-02 08:25:50.648: 03: [21974619] --> 221 2.0.0 See ya in
cyberspace
Wed 2022-02-02 08:25:50.648: 01: [21974619] SMTP session successful
(Bytes in/out: 3032/463)
Wed 2022-02-02 08:25:50.650: 01: ----------
--
--[mdaemon-l]----------------------------------------------------------
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server di Indonesia
Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Berlangganan: Kirim mail ke [email protected]
Henti Langgan: Kirim mail ke [email protected]
Versi terakhir: MDaemon 21.5.1, SecurityGateway 8.0.4
