From address spoofing my domain

@lbutlr kremels at
Sat Mar 19 22:47:11 CET 2016

A user has been getting a lot of spam with headers that look something like this:

From: Bosley at, Hair at, Restoration at
From: National at, Solar at, Network at,  
From: ObamacareInformation at    
From: OmegaK at, Heart at, Attack at,  
From: Penny at, Auction at, Deals at  
From: Perfect at, Water at, Purifier at  
From: Proactiv at, Special at, Offer at  
From: PCNN at, Breaking at, Now at 

I’m puzzle and wondering if there is something odd in my configuration that may be causing the From to appear this way or if it’s just some new spammer tactic.

I do have:

/covisp\.net$/ REJECT helo Don't spoof my hostname

In postfix’s helo_header_checks, but these are not the helo or From_ addresses.

Is it possible that amavisd is hitting an invalid From header like “Bosely Hair Restoration” and adding a “” to each word?

Here is the most recent one, lightly munged:

Return-Path: <contact at>
Delivered-To: *user1*@sqldomain.tld
Received: from (localhost [])
        by (Postfix) with ESMTP id 3qMYHl0KP2zpKv0;
        Fri, 11 Mar 2016 22:59:31 -0700 (MST)
X-Virus-Scanned: amavisd-new at
X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: part did not end with
        expected boundary; ; error: unexpected end of parts before epilogue
Received: from ([])
        by ( []) (amavisd-new, port 10024)
        with ESMTP id dCXNv3ebKRAi; Fri, 11 Mar 2016 22:59:29 -0700 (MST)
Received: from ( [])
        by (Postfix) with ESMTP id 3qMYHj5Rt4zpKts
        for <*user*@sqldomain.tld>; Fri, 11 Mar 2016 22:59:29 -0700 (MST)
Received: from localhost ( by id hseo4616lt0m for <*user*@sqldomain.tld>; Sat, 12 Mar 2016 00:22:44 -0500 (envelope-from <contact at>)
From: Reverse at, Mortgage at, Calculator at
To: "*user*@sqldomain.tld" <*user*@sqldomain.tld>
Subject: Are Reverse Mortgages: Too Good To Be True?

(the sqldomain.tld is NOT

I always take life with a grain of salt, plus a slice of lime and a
shot of tequila.

More information about the amavis-users mailing list