我一直在使用 rackspace 电子邮件服务，我发现恶意电子邮件看似来自[email protected]但[email protected]实际上并非由该用户发送。
根据 rackspace 的说法，这封电子邮件是[email protected]使用他的凭据发送的。从电子邮件标题中，我无法判断这是在 secureserver.net 上运行的脚本在执行此操作（使用他的凭据）还是发送了一封伪造的电子邮件（脚本发送 SMTP 而不进行身份验证，只是相应地设置电子邮件的收件人/发件人字段）。
我的问题是：
SMTP 服务器可以通过两种方式接收电子邮件：1) 从其他 SMTP 服务器接收，2) 或从通过其进行身份验证和中继的客户端接收。如果无法访问接收服务器日志，那么标头中指示客户端通过经过身份验证的用户名/密码进行中继的详细信息在哪里？
在添加附加详细信息的地方，这些是发件人伪造的还是真实的：？
X-Get-Message-Sender-Via: a2plcpnl0576.prod.iad2.secureserver.net: authenticated_id:[email protected]尽管我们有域的 SPF 记录，仅包含 Web 服务器 IP 并
include:emailsrvr.com带有-all标志，但 Rackspace 表示无法使用它来检查欺骗性电子邮件，还是因为他们已经向 SMTP 服务器进行了身份验证并在这种情况下进行了中继？
标题如下：
Delivered-To: [email protected]
Return-Path: <[email protected]>
Received: from smtp48.gate.iad3a (smtp48.gate.iad3a.rsapps.net [172.27.146.93]) by store370a.mail.iad3a (SMTP Server) with ESMTP id 6B21338004D for <[email protected]>; Tue, 22 Mar 2016 18:51:50 -0400 (EDT)
X-Spam-Threshold: 95
X-Spam-Score: 0
X-Spam-Flag: NO
X-Virus-Scanned: OK
X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-5195-c
X-CMAE-Scan-Result: 0
X-CNFS-Analysis: v=2.1 cv=Ksx0hwmN c=1 sm=0 tr=0 a=03oFrmF08fajSB7oc4goJw==:117 a=3DDquuGS2V5BkRhJnJP3ow==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=AsRiV6KZ74iSbj+k8RJYJIAeGPg=:19 a=2L8f7PMcNrQA:10 a=7OsogOcEt9IA:10 a=KXl77lDgDEgIEtoqJYcA:9 a=_6GpL_ENAAAA:8 a=ZYf_q_66Zn7mdDxIrUkA:9 a=giY71Mj1q15_ivv6:21 a=NF3jo81ehh1LRULu:21 a=wPNLvfGTeEIA:10 a=xupg4knwUDYA:10 a=iDzWDAaf-0_1B4d3PKkA:9 a=AX674DPcPDPt-UkY:21 a=v5bIRgG1RGZFvm2Y:21 a=_W_S_7VecoQA:10
X-Orig-To: [email protected]
X-Originating-Ip: [198.71.225.37]
Received: from [198.71.225.37] ([198.71.225.37:50277] helo=a2nlsmtp01-03.prod.iad2.secureserver.net) by smtp48.gate.iad3a.rsapps.net (envelope-from <[email protected]>) (ecelerity 2.2.3.49 r(42060/42061)) with ESMTPS (cipher=AES256-SHA) id B2/C7-21891-17EB1F65; Tue, 22 Mar 2016 18:51:50 -0400
Received: from a2plcpnl0576.prod.iad2.secureserver.net ([198.71.236.72]) by : HOSTING RELAY : with SMTP id iUAOaPfNohy43iUAOaMLT4; Tue, 22 Mar 2016 14:48:44 -0700
Message-ID: <[email protected]>
Received: from [77.234.42.143] (port=65110 helo=[100.100.48.14]) by a2plcpnl0576.prod.iad2.secureserver.net with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.85_1) (envelope-from <[email protected]>) id 1aiUAO-0010vj-5P for [email protected]; Tue, 22 Mar 2016 14:48:44 -0700
Content-Type: multipart/alternative; boundary="===============0122389713=="
MIME-Version: 1.0
Subject: Important
To: Recipients <[email protected]>
From: "Harry" <[email protected]>
Date: Tue, 22 Mar 2016 16:48:39 -0500
Reply-To: [email protected]
X-Antivirus: avast! (VPS 160322-0, 03/22/2016), Outbound message
X-Antivirus-Status: Clean
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - a2plcpnl0576.prod.iad2.secureserver.net
X-AntiAbuse: Original Domain - mydomain.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - mydomain.com
X-Get-Message-Sender-Via: a2plcpnl0576.prod.iad2.secureserver.net: authenticated_id: [email protected]
X-Source:
X-Source-Args:
X-Source-Dir:
X-CMAE-Envelope: MS4wfEPENpifHOCgRpfP6548FFaFh5aGvLkdZm1fLn1ObUi/GIxIvKJEpHzquISJMsZqy70pnMkKI97Q9A0DqQ32JQ78HW6S1tBah8JgoDrTNI9F4pp4EDOM HTkGtTYtUC9r9UUrKvESTtmSFszS6652/MgX84oIFe88If6ClU4eOj36h5+xgnUIKFWOr106/ju1qIlkFmQeQS7UynivyRiK6r8QHvsju7aabN+eUPHBb+4qI
答案1
关键行在这里。
Received:
from [77.234.42.143] (port=65110 helo=[100.100.48.14])
by a2plcpnl0576.prod.iad2.secureserver.net
with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.85_1)
(envelope-from <[email protected]>) id 1aiUAO-0010vj-5P
for [email protected]; Tue, 22 Mar 2016 14:48:44 -0700
它说a2plcpnl0576.prod.iad2.secureserver.net收到了一条消息SMTP 验证此处缩写为ESMTPSA来自[77.234.42.143]，其自身标识为[100.100.48.14]（来自第二层非公共 IP 地址空间，又称运营商级 NAT）。
77.234.42.143解析为ten.emfme.net应该会给我们实际的发件人。由于此 IP 地址属于 AVAST 云，您可以从 获得有关来自此 IP 的消息的更多详细信息[email protected]。