<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 12/1/11 7:02 AM, Andreas Neustifter wrote:
<blockquote
cite="mid:CAKzUsjEG6b9kJ4pY_bTxn7FxbuMSpiSfk1+NgotgLzYgssd1og@mail.gmail.com"
type="cite">
<pre wrap="">Hi List!
Sometimes a email gets forwarded from our spam filter (single machine,
amavis+postfix+spamassassin+clamav, pretty simple setup) to the
exchange server that have no spam headers (although
'$sa_tag_level_deflt = -999') and even have no received headers.
Those mails do not appear in mail.log, but they do appear in the
exchange logs as received from the spam filter.
It seems as if those mails are materializing from thin air on the spam filter.
Any ideas what could be the problem in this case? (I have checked the
access logs, nothing out of the ordinary...)
</pre>
</blockquote>
submit port, 587? someone sending directly to port 10025? using
imap(s) to send emails?<br>
<br>
other things, make sure that the 'sending' domain isn't your local
domain? (marked 'local=y' in db? )<br>
make sure receivng domain IS?<br>
<br>
run tcpdump? tcpflow and see if you can catch it?<br>
<br>
being actually BOUNCED to/from the exchange server?<br>
<br>
are they spam or legit?<br>
<br>
<blockquote
cite="mid:CAKzUsjEG6b9kJ4pY_bTxn7FxbuMSpiSfk1+NgotgLzYgssd1og@mail.gmail.com"
type="cite">
<pre wrap="">Thanks, Andi
</pre>
</blockquote>
<br>
<br>
<div class="moz-signature">-- <br>
Michael Scheidell, CTO<br>
o: 561-999-5000<br>
d: 561-948-2259<br>
<font color="#999999">></font><font color="#cc0000"> <b>| </b></font>SECNAP
Network Security Corporation
<style type="text/css">
<!--
.unnamed1 {
margin: 1em;
padding: 1px;
} -->
</style>
<ul class="unnamed1">
<li>Best Mobile Solutions Product of 2011</li>
<li>Best Intrusion Prevention Product</li>
<li>Hot Company Finalist 2011</li>
<li>Best Email Security Product</li>
<li>Certified SNORT Integrator</li>
</ul>
</div>
<br>
<div id="disclaimer.secnap.com"><hr />This email has been scanned and certified safe by SpammerTrap®.</div>
<div>For Information please see
<a href="http://www.spammertrap.com/">http://www.spammertrap.com/</a> <hr /></div>
<br>
</body>
</html>