Hi,
We use Postfix - Dovecot – Sympa – spamassassin – clamav on an Ubuntu 14.04 server. Last week we sent out a message to a Sympa mailing list and one of the e-mail addresses was in Costa-Rica. (@ucr.ac.cr) Since then we keep receiving an e-mail from their Cisco Iron Port system about every 10 seconds and we are unable to stop it, even after installing spamassassin and clamav. This is the message: - - quote - - - - - - - From: SYMPA <[email protected]> To: Listmaster [email protected] Subject: Listmaster: internal server error. User "Iron Port Bounce Messages" <[email protected]> has encountered an internal server error (message diffusion - MSG_ID: <[email protected]> - LIST: [email protected]): Impossible to forward a message to oceandocscommunity-owner : undefined in this list See the logs for more details. - - unquote - - - - - - - This it the original message as it gets stopped by the mailing list server because the sender is not a list member. At this point I receive the above e-mail. In the e-mail details below, I can find that the message is sent by [email protected] but even adding this e-mail address to the Postfix blacklist has no effect. This is new to me so any advise about what I’m doing wrong and how to stop this is very welcome. Have a nice weekend, Mark - - quote - - - - root@mail:/home/sympa/spool/msg# more [email protected] X-Sympa-To: [email protected] Return-Path: <MAILER-DAEMON> Received: from localhost (localhost [127.0.0.1]) by mail.iode.org (Postfix) with ESMTP id F04F71CAB for <oceandocscommunity-owner+sympa.iode.org@sympalist>; Tue, 17 Jan 2017 14:43:11 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at mail.iode.org Received: from mail.iode.org ([127.0.0.1]) by localhost (mail.iode.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 40K8jY3dGAFm for <oceandocscommunity-owner+sympa.iode.org@sympalist>; Tue, 17 Jan 2017 14:43:02 +0100 (CET) Received: from relay.vliz.be (unknown [192.168.5.217]) by mail.iode.org (Postfix) with ESMTPS id 026047C0B for <[email protected]>; Tue, 17 Jan 2017 14:42:57 +0100 (CET) X-ASG-Debug-ID: 1484660575-0ab9595f3b144d50001-JGkER2 Received: from litio.ucr.ac.cr (litio.ucr.ac.cr [163.178.174.20]) by relay.vliz.be with ESMTP id 4HXbovzmQeqq83KP (version=TLSv1.2 cipher=RC4-SHA bits=128 veri fy=NO) for <[email protected]>; Tue, 17 Jan 2017 14:42:58 +0100 (CET) X-Barracuda-Envelope-From: X-Barracuda-Effective-Source-IP: litio.ucr.ac.cr[163.178.174.20] X-Barracuda-Apparent-Source-IP: 163.178.174.20 Received: from localhost by litio.ucr.ac.cr; 17 Jan 2017 07:42:58 -0600 Message-Id: <[email protected]> Date: 17 Jan 2017 07:42:58 -0600 To: [email protected] From: "Iron Port Bounce Messages" <[email protected]> Subject: Delivery Status Notification (Failure) MIME-Version: 1.0 X-ASG-Orig-Subj: Delivery Status Notification (Failure) Content-Type: multipart/report; report-type=delivery-status; boundary="pMHD.5HafwOhEa.5lmdOk+/TUE.COVHwLW" X-Barracuda-Connect: litio.ucr.ac.cr[163.178.174.20] X-Barracuda-Start-Time: 1484660577 X-Barracuda-Encrypted: RC4-SHA X-Barracuda-URL: https://relay.vliz.be:443/cgi-mod/mark.cgi X-Barracuda-Scan-Msg-Size: 230 X-Virus-Scanned: by bsmtpd at vliz.be X-Barracuda-BRTS-Status: 1 X-Barracuda-Spam-Score: 0.20 X-Barracuda-Spam-Status: No, SCORE=0.20 using global scores of TAG_LEVEL=3.0 QUARANTINE_LEVEL=4.0 KILL_LEVEL=5.0 tests=ANY_BOUNCE_MESSAGE, BOUNCE_MESSAGE, BSF_ SC0_SA590, EMPTY_ENV_FROM X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.3.35864 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- 0.00 EMPTY_ENV_FROM Empty Envelope From Address 0.20 BSF_SC0_SA590 Custom Rule SA590 0.00 BOUNCE_MESSAGE MTA bounce message 0.00 ANY_BOUNCE_MESSAGE Message is some kind of bounce message --pMHD.5HafwOhEa.5lmdOk+/TUE.COVHwLW content-type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following message to <[email protected]> was undeliverable. The reason for the problem: 5.1.0 - Unknown address error 550-'5.1.1 <[email protected]>: Recipient ad= dress rejected: User unknown in virtual mailbox table' --pMHD.5HafwOhEa.5lmdOk+/TUE.COVHwLW content-type: message/delivery-status Reporting-MTA: dns; litio.ucr.ac.cr Final-Recipient: rfc822;[email protected] Action: failed Status: 5.0.0 (permanent failure) Remote-MTA: dns; [163.178.163.178] Diagnostic-Code: smtp; 5.1.0 - Unknown address error 550-'5.1.1 <[email protected]>: Recipient address rejected: User unknown in virtual mailbox table' (deliv ery attempts: 0) --pMHD.5HafwOhEa.5lmdOk+/TUE.COVHwLW content-type: message/rfc822 IronPort-PHdr: =?us-ascii?q?9a23=3ABBkzixKmSHBBlHKHbdmcpTZWNBhigK39O0sv0rFi?= =?us-ascii?q?tYgRLP3xwZ3uMQTl6Ol3ixeRBMOAuq4C0LWd7/2ocFdDyK7JiGoFfp1IWk1Nou?= =?us-ascii?q?QttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBXdrXKo8DEdBAj0OxZr?= =?us-ascii?q?KeTpAI7SiNm82/yv95HJbQhFgDWwbal8IRi0ogncuckbipZ+J6gszRfEvmFGcP?= =?us-ascii?q?lMy2NyIlKTkRf85sOu85Nm7i9dpfEv+dNeXKvjZ6g3QqBWAzogM2Au+c3krgLD?= =?us-ascii?q?QheV5nsdSWoZjBxFCBXY4R7gX5fxtiz6tvdh2CSfIMb7Q6w4VSik4qx2UxLjlj?= =?us-ascii?q?sJOCAl/2HWksxwjbxUoBS9pxxk3oXYZJiZOOdicq/BeN8XQ3dKUMRMWCxbGo6y?= =?us-ascii?q?bIUBAOUBM+hGsofyu1QAoxylCAmpB+7i0CVFi2Xq0aEk1ekqDAHI3BYnH9ILqH?= =?us-ascii?q?nasdf6OqAIX+2p0aLFyi7DbvNT2Tfl8ofFaQshoPGJXbJoa8Xd00gvFwTYgVqO?= =?us-ascii?q?s4DlOCmV1usUvmWd8uFuVvqvhnY6pwx1rDWj3Nogh43Uio4P11zJ+yp0zJwxKN?= =?us-ascii?q?C+VUV1e8SrEIFKuCGfL4Z2Qt0tQ2VvuCsiz70Jo5+7fCwQxJQmwB7QduKIf5KP?= =?us-ascii?q?4hL5W+adOTZ4hHR7d7Kjnxu+7Eytx+PmWsWp1FtGszBJnsTCu30CzRDe7tCLSv?= =?us-ascii?q?5n8Ueg3TaP2RrT6uZBIU0skqrUN4AuzaQ2lpUOtkTMAjT2l1nxjK+Tc0Uk5+6o?= =?us-ascii?q?6+X7YrTmv5OcMIF1igfgPaQ0gcG/GuQ5Mg0WX2eB4+i81brj8lDnT7lQif02iK?= =?us-ascii?q?bZvIjAJcsHvq65HxNV0oE75ha+FTem19IYnWEALFJfZBKKlJXpNE3UIPziF/iw?= =?us-ascii?q?n06gnytxx6OOArq0SLTXKX6LqLD7Yf5X7FNawwd76N1E/JtbB6pLaKbyQEj3rN?= =?us-ascii?q?vCEjckOBbyyu2hA88rha0EXmfaOZ68CIqa5USZ4/omC/KdYZcc/jf6J/Vj4OTh?= =?us-ascii?q?2yxq0WQBdLWkiMNEIEuzGe5rdgDAOSLh?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0GuIgBOE35YlwmGv8FdDg4BAQQBAQoBA?= =?us-ascii?q?RcBAQQBAQoBAYMOAQEBAQGCB4MDTpwAiFCMfIpBSA8BAQEBAQEBAQEBAQIQAQE?= =?us-ascii?q?BAQEIFghNQhIBgV4bAYJEDwGBFQ4CIQ0xE4kHnx6QAYIhBIo/hkSCC4cGCYMcg?= =?us-ascii?q?l4FiHMYh16KPRQbgTCBBY8PG4FchQ6JaJJsSQKBXgiELoIDPD01hVlRgi4BAQE?= X-IPAS-Result: =?us-ascii?q?A0GuIgBOE35YlwmGv8FdDg4BAQQBAQoBARcBAQQBAQoBAYM?= =?us-ascii?q?OAQEBAQGCB4MDTpwAiFCMfIpBSA8BAQEBAQEBAQEBAQIQAQEBAQEIFghNQhIBg?= =?us-ascii?q?V4bAYJEDwGBFQ4CIQ0xE4kHnx6QAYIhBIo/hkSCC4cGCYMcgl4FiHMYh16KPRQ?= =?us-ascii?q?bgTCBBY8PG4FchQ6JaJJsSQKBXgiELoIDPD01hVlRgi4BAQE?= X-IronPort-AV: E=Sophos;i="5.33,244,1477980000"; d="scan'208";a="13460557" Received: from mail.iode.org ([193.191.134.9]) by litio.ucr.ac.cr with ESMTP; 17 Jan 2017 07:42:55 -0600 Received: by mail.iode.org (Postfix, from userid 1001) id B109A20F3; Tue, 17 Jan 2017 14:42:49 +0100 (CET) Message-Id: <[email protected]> Date: Tue, 17 Jan 2017 14:42:49 +0100 MIME-Version: 1.0 Auto-Submitted: auto-replied From: SYMPA <[email protected]> To: "Iron Port Bounce Messages" <[email protected]> Subject: Message distribution: Internal server error Content-Type: multipart/mixed; boundary="----------=_<[email protected]>" Content-Transfer-Encoding: 8bit X-Mailer: Sympa 6.1.19 --pMHD.5HafwOhEa.5lmdOk+/TUE.COVHwLW-- - - unquote - - - -
