我有一个运行 Postfix 的 iRedMail 服务器，正在尝试确定其垃圾邮件问题的根源。
此后，我更改了接收垃圾邮件的地址的域上的 MX 记录，好消息是没有垃圾邮件通过这台第二台服务器。但是，尽管 MX 记录已更改，但新的垃圾邮件仍不断出现在旧服务器上。这怎么可能呢？
以下是其中一封垃圾邮件的标题：
Content-Type: multipart/alternative; boundary="6656864_13052705_6656864"
Mime-Version: 1.0
Return-Path: <[email protected]>
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: Debian amavisd-new at myserverdomain.com
Received: from localhost (localhost [127.0.0.1]) by myserverdomain.com (Postfix) with ESMTP id 293FD6B977 for <[email protected]>; Tue, 12 Jan 2016 20:45:14 -0700 (MST)
Received: from myserverdomain.com ([127.0.0.1]) by localhost (myserverdomain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G3TC68wvWWEK for <[email protected]>; Tue, 12 Jan 2016 20:45:13 -0700 (MST)
Received: from yuijdd.stablecheck.party (unknown [46.166.133.21]) by myserverdomain.com (Postfix) with ESMTP id 480626B976 for <[email protected]>; Tue, 12 Jan 2016 20:45:12 -0700 (MST)
Delivered-To: [email protected]
Message-Id: <Lackadaisical.0300b221f33a2b213a8dc0ee683baadac.Obsecratorynick@emaildomain.com>
Re: Macy's is giving out a $50 voucher to start 2016
这似乎是来自我自己的服务器吗？还是来自这个 IP？：46.166.133.21。该 IP 在 Spamhaus 上被列入黑名单，我已将后缀设置为查询。
/var/logs/mail.log这是我的文件的一部分
Jan 13 03:45:11 mailhost postfix/smtpd[4796]: connect from unknown[46.166.133.21]
Jan 13 03:45:12 mailhost postfix/smtpd[4796]: 480626B976: client=unknown[46.166.133.21]
Jan 13 03:45:12 mailhost postfix/cleanup[4806]: 480626B976: message-id=<Lackadaisical.0300b221f33a2b213a8dc0ee683baadac.Obsecratorynick@emaildomain.com>
Jan 13 03:45:13 mailhost postfix/qmgr[9274]: 480626B976: from=<[email protected]>, size=5484, nrcpt=1 (queue active)
Jan 13 03:45:13 mailhost postfix/smtpd[4796]: disconnect from unknown[46.166.133.21]
Jan 13 03:45:14 mailhost postfix/smtpd[4815]: connect from localhost[127.0.0.1]
Jan 13 03:45:14 mailhost postfix/smtpd[4815]: 293FD6B977: client=localhost[127.0.0.1]
Jan 13 03:45:14 mailhost postfix/cleanup[4806]: 293FD6B977: message-id=<Lackadaisical.0300b221f33a2b213a8dc0ee683baadac.Obsecratorynick@emaildomain.com>
Jan 13 03:45:14 mailhost postfix/qmgr[9274]: 293FD6B977: from=<[email protected]>, size=5943, nrcpt=1 (queue active)
Jan 13 03:45:14 mailhost postfix/smtpd[4815]: disconnect from localhost[127.0.0.1]
Jan 13 03:45:14 mailhost amavis[31884]: (31884-08) Passed CLEAN, LOCAL [46.166.133.21] [46.166.133.21] <[email protected]> -> <[email protected]>, Message-ID: <Lackadaisical.0300b221f33a2b213a8dc0ee683baadac.Obsecratorynick@emaildomain.com>, mail_id: G3TC68wvWWEK, Hits: -0.546, size: 5482, queued_as: 293FD6B977, 568 ms
Jan 13 03:45:14 mailhost postfix/smtp[4812]: 480626B976: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=2, delays=1.4/0.01/0.01/0.58, dsn=2.0.0, status=sent (250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 293FD6B977)
Jan 13 03:45:14 mailhost postfix/qmgr[9274]: 480626B976: removed
Jan 13 03:45:14 mailhost postfix/pipe[4816]: 293FD6B977: to=<[email protected]>, relay=dovecot, delay=0.09, delays=0.01/0.01/0/0.07, dsn=2.0.0, status=sent (delivered via dovecot service)
我还认为可能存在某个地方的 PHP 脚本发送这封邮件，因此我安装并运行了 Linux Malware Detect，但什么也没发现。
感谢您的帮助！
编辑：我在 main.cf 中启用了黑名单过滤
smtpd_recipient_restrictions =
reject_rbl_client zen.spamhaus.org,
reject_rbl_client bl.spamcop.net,
reject_rbl_client cbl.abuseat.org,
reject_rbl_client b.barracudacentral.org,
reject_invalid_hostname,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
check_policy_service inet:127.0.0.1:7777,
check_policy_service inet:127.0.0.1:10031,
reject_non_fqdn_sender,
reject_non_fqdn_hostname,
reject_non_fqdn_recipient,
reject_unlisted_recipient,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
permit
答案1
该电子邮件来自您服务器之外的指定 IP 地址。
Postfix 配置为将其传递给 Amavis 进行病毒扫描，完成后，Amavis 将其传回 Postfix 进行传送。
这就是为什么有两行 localhost Received:。一行是 Amavis 在处理邮件时添加的，另一行是 Postfix 从 Amavis 重新接受邮件并进行最终投递时添加的。