CODEWITHSUNDEEP
qmail
Mich Dart
Mich Dart

Reputation: 2422

Qmail Log: lots of UNAUTHENTICATED SENDER

On qmail logs there are lots of the following lines:

2012-12-14 18:04:49.314299500 simscan:[9999]:CLEAN (4.00/50.00):2.2875s:Delivery Status Notification (Failure):aa.aa.aa.aa::[email protected]
2012-12-14 18:04:49.657999500 CHKUSER accepted rcpt: from <::> remote <utility-xxxx.it:unknown:aa.aa.aa.aa> rcpt <[email protected]> : found existing recipient
2012-12-14 18:04:49.658005500 policy_check: local  -> local [email protected] (UNAUTHENTICATED SENDER)
2012-12-14 18:04:49.658016500 policy_check: policy allows transmission
2012-12-14 18:04:49.658019500 spamdyke[9945]: ALLOWED from: (unknown) to: [email protected] origin_ip: 82.85.185.32 origin_rdns: utility-xxxxx.it auth: (unknown)

and

12-14 18:03:57 CHKUSER accepted rcpt: from <::> remote <utility-xxxx.it:unknown:aa.aa.aa.aa> rcpt <[email protected]> : found existing recipient
12-14 18:03:57 policy_check: local  -> local [email protected] (UNAUTHENTICATED SENDER)
12-14 18:03:57 spamdyke[9945]: ALLOWED from: (unknown) to: [email protected] origin_ip: aa.aa.aa.aa origin_rdns: utility-xxxx.it auth: (unknown)
12-14 18:03:59 simscan:[9999]:CLEAN (4.00/50.00):2.4153s:Delivery Status Notification (Failure):aa.aa.aa.aa::[email protected]
12-14 18:04:00 CHKUSER accepted rcpt: from <::> remote <utility-xxxx.it:unknown:aa.aa.aa.aa> rcpt <[email protected]> : found existing recipient
12-14 18:04:00 policy_check: local  -> local [email protected] (UNAUTHENTICATED SENDER)
12-14 18:04:00 spamdyke[9945]: ALLOWED from: (unknown) to: [email protected] origin_ip: aa.aa.aa.aa origin_rdns: utility-xxxx.it auth: (unknown)
12-14 18:04:02 simscan:[9999]:CLEAN (4.00/50.00):2.5481s:Delivery Status Notification (Failure):aa.aa.aa.aa::[email protected]
12-14 18:04:02 CHKUSER accepted rcpt: from <::> remote <utility-xxxx.it:unknown:aa.aa.aa.aa> rcpt <[email protected]> : found existing recipient
12-14 18:04:02 policy_check: local  -> local [email protected] (UNAUTHENTICATED SENDER)
12-14 18:04:02 spamdyke[9945]: ALLOWED from: (unknown) to: [email protected] origin_ip: aa.aa.aa.aa origin_rdns: utility-xxxx.it auth: (unknown)

Does this mean something unwanted? Thank you... I'm completely new to qmail

Upvotes: 1

Views: 995

Answers (1)

Anshul
Anshul

Reputation: 1446

possibly these are the bounce message recieved by the user [email protected]

12-14 18:03:57 CHKUSER accepted rcpt: from <::> remote rcpt : found existing recipient

It is possible that someone has spoofed the mail id of sender and might be performing some spam activity. And as we all know spammers send mails to random ids and most of which do-not exists. In return the sender id would get a bounce message.

Just verify it.

Upvotes: 0

Related Questions