Is my mail server an open relay (I hope not)

[dougconran]

I always seem to have a number of messages in my out queue purporting to come from me which I know I've not sent, does this mean that my mail server is an open relay? I'm adding some output from the mailq command plus part of my main.cf file below.

We have very few real users on the system (just 5 of whom only 2 are really active). Most mail is addressed to virtual users set up in the aliases file. 2 of these virtual addresses accept 'help' requests which then automatically return details of the requested service to the sender.

One other point of note is that I (dconran) receive a lot of spam mail, most of which is filtered out by Spamassassin.

As far as I can see from reading the man pages etc my server is not an open relay but, if that is so, why so many junk messages going out?

Part of mailq command:

A7F33FBB8A      568 Sun Jun 26 05:55:18  dconran@corunna.com
          (connect to mail.doneasy.com[205.234.145.230]: Connection timed out)
                                         kadakia@doneasy.com

B2C75FDAFC      571 Wed Jun 29 01:54:11  dconran@corunna.com
                             (Name service error for dev.null: Host not found)
                                         nhaceoqi@weblizard.net

BE555FC3F1      577 Sun Jun 26 14:39:25  dconran@corunna.com
(host customers.nameserv.com[216.22.18.7] said: 450 <sqgwovytei@mail.gigapack.com>: Recipient addres
s rejected: User unknown in virtual alias table)
                                         sqgwovytei@mail.gigapack.com

C52BEFC01A      576 Tue Jun 28 04:19:39  dconran@corunna.com
             (connect to q.internetcity.com[207.153.6.82]: Connection refused)
                                         lkyfywondjbui@flairmail.com

C61FDFDA67      577 Sat Jun 25 02:14:56  dconran@corunna.com
           (connect to mortgage-lowsz.com[211.156.249.72]: Connection refused)
                                         potter.jhz@mortgage-lowsz.com

CFBD8FCD49      578 Sat Jun 25 12:50:21  dconran@corunna.com
                         (Name service error for null.ras.net: Host not found)
                                         jaqpjagnec@straightforward.com

D8AC6FDAF4      572 Tue Jun 28 23:57:49  dconran@corunna.com
                             (Name service error for dev.null: Host not found)
                                         zzsdojroia@netmanor.com

DAF24FD7F0      581 Wed Jun 29 10:56:46  dconran@corunna.com
         (Name service error for johnpritchard.com: Host not found, try again)
                                         revamalone6440@johnpritchard.com

DC7FDFCE29      579 Mon Jun 27 01:24:59  dconran@corunna.com
        (connect to www43.wr.outblaze.com[205.158.62.105]: Connection refused)
                                         rjepligjp@mail.nctta.org

-- 146 Kbytes in 35 Requests.

Part of my main.cf file

masquerade_exceptions = root
masquerade_classes = envelope_sender, header_sender, header_recipient, envelope_recipient
myhostname = corunna1.corunna.com
mydomain = corunna.com
inet_interfaces = 127.0.0.1, 213.131.179.232
masquerade_domains = $mydomain
mydestination = $myhostname, localhost.$mydomain, $mydomain, [URL unfurl="true"]www.$mydomain,[/URL] tcl-portal.com
myorigin = $mydomain
mynetworks_style = host
defer_transports =
default_transport = smtp
disable_dns_lookups = no
relayhost =
content_filter =
mailbox_command =
mailbox_transport =
# smtpd_sender_restrictions = hash:/etc/postfix/access
# smtpd_client_restrictions =
smtpd_helo_required = yes
smtpd_helo_restrictions =
strict_rfc821_envelopes = yes
relay_domains = $mydestination,tcl-portal.com,wta-otis.co.uk
smtpd_recipient_restrictions = permit_mynetworks,check_relay_domains
alias_maps = hash:/etc/aliases
local_recipient_maps = $alias_maps unix:passwd.byname
default_privs = dconran
message_size_limit = 51200000

Any help/advice would be much appreciated.

TIA

Doug

 

[jkupski]

It doesn't appear to me that you are an open relay--though it's possible if the mynetworks directive (not included in the above) is allowing the world.

http://www.abuse.net/relay.html

will tell you for sure if you're an open relay, though.

Most of those messages in your logs appear to be sent to reply-to addresses being used by spammers. No idea why they are being sent as you instead of, say, mailer-daemon.

 

[dougconran]

Many thanks. I've tried the link you suggested and it would appear that I am safe.

I suspect that the messages are appearing to come from me rather than mailer-daemon because root is aliased to me and mailer-daemon is aliased to root.

Thanks again,

Doug

 

[lgarner]

There's a list of checkers at

http://spamlinks.net/prevent-secure-relay-test.htm.

I've only used a couple of them, myself.