Re: spam - headers: from ME to ME, but different anvelope sender

[wiseadmin]

All emails are reveived through smtp and then they are passed to spamd, inspected and delivered. If I say something stupid, please excuse me, I am experienced with linux and networking in general bun not to postfix and email servers. I sent an email to myself and grep in the logs. yadmin@cma:~$ egrep '718D9116266|A792B105AF0' /var/log/mail.log Sep  6 17:35:22 cma postfix/smtpd[28457]: A792B105AF0: client=mail-ea0-f182.google.com[209.85.215.182] Sep  6 17:35:22 cma postfix/cleanup[1067]: A792B105AF0: message-id=<5229e81c.6010...@gmail.com> Sep  6 17:35:22 cma postfix/qmgr[19671]: A792B105AF0: from=<wisead...@gmail.com>, size=1808, nrcpt=1 (queue active) Sep  6 17:35:28 cma postfix/pickup[810]: 718D9116266: uid=1018 from=<wisead...@gmail.com> Sep  6 17:35:28 cma postfix/cleanup[1067]: 718D9116266: message-id=<5229e81c.6010...@gmail.com> Sep  6 17:35:28 cma postfix/pipe[1069]: A792B105AF0: to=<us...@mydomain.ro>, relay=spamassassin, delay=8.3, delays=2.7/0/0/5.6, dsn=2.0.0, status=sent (delivered via spamassassin service) Sep  6 17:35:28 cma postfix/qmgr[19671]: A792B105AF0: removed Sep  6 17:35:28 cma postfix/qmgr[19671]: 718D9116266: from=<wisead...@gmail.com>, size=2169, nrcpt=1 (queue active) Sep  6 17:35:28 cma postfix/virtual[1068]: 718D9116266: to=<us...@mydomain.ro>, relay=virtual, delay=0.34, delays=0.29/0/0/0.05, dsn=2.0.0, status=sent (delivered to maildir) Sep  6 17:35:28 cma postfix/qmgr[19671]: 718D9116266: removed On 09/06/2013 05:10 PM, Wijatmoko U. Prayitno wrote: On Fri, 6 Sep 2013 10:05:49 -0400 (EDT) wie...@porcupine.org (Wietse Venema) wrote: /var/log/mail.log.1:Sep 5 17:10:06 cma postfix/pickup[17510]: A3E8C10BADF: uid=1018 from=<stronges...@google.com> The email came from local user uid 1018 (service pickup). Good observation. This message did not come via SMTP. You have a buggy web application. Maybe the spamd are listen on all interface, so it opened to the whole internet.