I have Ubuntu server which is more or less acting as a web and mysql server. There is no postfix or anything similar installed. With a help of Virtualbox there is also virtualised Ubuntu server which is acting like a mail server with a help of iredmail.

I use it for a project I'm a part of and mail server is used only for contacting clients (no more than 10 mails per day for now).

The problem is that we're blacklisted for sending spam and we also have been notified from ISP about that problem which forwarded me an example of send email. I checked logs on both servers and there was nothing sent other than from our team and to our clients. Just a couple of

Helo command rejected: need fully-qualified hostname


Relay access denied

There is no other computers in the network with installed mail clients or servers.

This is header of one of the spam mail sent

Received: from jhkbabkgjkceaej.meetgir.com (redacted.static.t-2.net [redacted])
    by mtaig-mcd06.mx.aol.com (Internet Inbound) with SMTP id 444BD700000A7
    for <[email protected]>; Thu, 16 Oct 2014 13:43:19 -0400 (EDT)
Return-Path: <[email protected]>
From: "Melanie Richards" <[email protected]>
To: <[email protected]>
References: <[email protected]>
Subject: From a pleasant-looking neighbor girl...
Date: Thu, 16 Oct 2014 21:44:48 +0200
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain;
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQKotpYqBnSwfJ0T5FucSHP5//9yxAKotpYq

Is there anything I can do to solve this problem? I appreciate your time and help. Thanks

  • 1
    I think you don't have a reverse dns server configured so other systems will just drop your messages. Take a look here support.simpledns.com/kb/a45/… for a full explanation.
    – vfbsilva
    Commented Oct 27, 2014 at 2:00
  • possible duplicate of Helo command rejected: need fully-qualified hostname Error
    – vfbsilva
    Commented Oct 27, 2014 at 2:03
  • Your webserver might be compromised, the bad guys may have uploaded a script that they use to send out email. Check your webserver access logs for around the time that spam message was sent.
    – wurtel
    Commented Oct 27, 2014 at 9:59

1 Answer 1

Received: from jhkbabkgjkceaej.meetgir.com (redacted.static.t-2.net [redacted])

That first line is a pretty good indication that you have an infection on the webserver. If you had some sort of accidental relaying enabled it would be "from" your usual host name. What you probably have is a script directly making SMTP connections to destination mail servers from your server.

Removing an infection is a topic all its own, but what you can do right away to get your client emails delivered again is to configure your chrooted mail server to relay your outgoing mail to a relaying service. Most cable-company accounts will come with a relay server you can use, and they monitor it for spam on the fly so it doesn't get blacklisted. There are also paid services available that do the same thing. The virus won't know to use this relay, so the real mail will go through and the spam coming from your server will still get blocked by the blacklist.

In the longer run, what you can do is set up firewall rules to block outgoing mail connections to any server other than your official relay, and set off some kind of alert that lets you know your server has been infected.

  • Thank you for this explanation. But wouldn't that leave some logs? There is no outgoing mail logged except from legitimate mail. I do have however a lot of this and similar: connect from server88-208-233-4.live-servers.net[] lost connection after UNKNOWN from server88-208-233-4.live-servers.net[] disconnect from server88-208-233-4.live-servers.net[]
    – Soriyyx
    Commented Oct 29, 2014 at 18:07
  • 1
    Nope. If the infection makes a direct TCP connection to the target mail server, they aren't going through any of your mail infrastructure. The only thing you would find in any log is if this is a PHP script or CGI script, then you will see someone making a web request with strange parameters. (unless they've disguised it really well)
    – M Conrad
    Commented Oct 30, 2014 at 5:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .