SPAM problem.

[#1]

Hello, I think that my problem doesn' t have the origin in the fortigate box that I' m using, so please excuse me if I post an off topic problem that I' m having. My problem is that since I enabled antispam filter on my fortigate box I receive a lot of emails with rejected mesages sent out from my network. All the emails are spam so I understand why they get rejected, what I don' t undestand is were they come from. I' m posting a mesage maybe someone has a better undestanding off what is going on. The original message was received at Thu, 28 Aug 2008 12:11:52 +0300 from [router_internal_ip_address] ----- The following addresses had permanent fatal errors ----- <sundog46@edirect168.com> (reason: 554 mail server permanently rejected message (#5.3.0)) ----- Transcript of session follows ----- ... while talking to mx1.url.com.tw.: >>> DATA <<< 554 mail server permanently rejected message (#5.3.0) 554 5.0.0 Service unavailable ... while talking to spamgw1.tnc.edu.tw.: >>> DATA <<< 421 Service unavailable - try again later <uang1025@jl2jh.tnc.edu.tw>... Deferred: Connection reset by spamgw1.tnc.edu.tw. ... while talking to mx1.mail.tw.yahoo.com.: >>> QUIT <<< 453 Mail from router_public_ip_address not allowed - [90] ... while talking to mx2.mail.tw.yahoo.com.: >>> DATA <<< 451 Message temporarily deferred - [90] <she4364651@yahoo.com.tw>,<jig146178@yahoo.com.tw>,<patricia121176@yahoo.com.tw>,<mhans1213tw@yahoo.com.tw>... Deferred: 451 Message temporarily deferred - [90] <ntn00378006@yaoo.com.tw>... Deferred: Connection timed out with yaoo.com.tw.

[UkWizard]

It looks like either your mail server is relaying spam or a host internally is being used as a spam sender. check your oubound connections to dest port 25, and see what internal hosts are sending them. where you say router IP, i presume you mean the fortinets IP.

[#3]

Yes, where I say router IP I mean my fortigate box. I did some checking and my mail server is not an open relay. How can it relay spam then. It seems that the outbound sessions on port 25 are coming from my email server. What is odd is that this problem omly appeared after I switched on the antispam feature on the fgt box.

[abelio]

Marius, check your mailserver IP (s) against FortiGuard AS database. You can do that at: http://www.fortiguardcenter.com/antispam/antispam.html

[#5]

" my_IP" is not blacklisted in the signature database. I had NAT checked on the firewall policy that allows PAT to be performed on smtp service. Think that was the problem?? I red on the forum that it should not be checked.

[abelio]

" my_IP" is not blacklisted in the signature database.

good; let' s think another things. What do the logs say? Verify that those annoying mails really are sent by your smtp server. Bounced mails you' ve posted could be sent by another host with fake addresses within your domain and you only are receiving those bounces. Last thing: could you post which antispam settings did you enable in that ' smtp' profile?

I had NAT checked on the firewall policy that allows PAT to be performed on smtp service. Think that was the problem?? I red on the forum that it should not be checked.

Not related with your problem at first If you' ve checked NAT for a firewall policy, the incoming mails appears becoming from FTG interface and not from original sources.

[UkWizard]

could this just be a coincidence, as spammers occasionally start using your domain name for sending their spam, with random source email addresses. These end up bouncing back to you even though you didnt sent them, their isnt anyway around this if this is whats happening. We could do with some more information on the problem really? can you post a couple of example email header info. and say what the source and dest email addresses are.

[#8]

So, the source of the emails are not from my mail server. They are random source email address just like UkWizzard sad. Here are some examples: source: gxttnaitixdcbw@schmumpf.de destination: cjm@ms.boe.ttct.edu.tw source: emilbtbzonazqjlav@pcfusion.com.au destination:a2783@ms6.hinet.net source: msbfuwagclm@doj.ca.gov destination:yatw@ms32.hinet.net Antipam sttings for smtp: ip address check URL check E-mail checksum spam submission IP address BWL check Helo DNS lookup Return e-amil DNS check Spam Action discard I just receive the bounces the only thing I can U give is this: The original message was received at Thu, 28 Aug 2008 10:48:37 +0300 from [192.168.12.254] -> my internal router address ----- The following addresses had permanent fatal errors ----- <randyhsu@arcoa.com.tw> (reason: 554 M.5 <randyhsu@arcoa.com.tw>... User unknown(Local Mailbox)) <s93910@mail2.tses.toc.edu.tw> (reason: 550 Host unknown) <s84195@scps.tpc.edu.tw> (reason: 550 5.1.1 <s84195@scps.tpc.edu.tw>... User unknown) <sandy234@unitech.com.tw> (reason: 550 Recipient not in route list.) ----- Transcript of session follows ----- ... while talking to bmail.arcoa.com.tw.: >>> RCPT To:<randyhsu@arcoa.com.tw> <<< 554 M.5 <randyhsu@arcoa.com.tw>... User unknown(Local Mailbox) 554 5.0.0 Service unavailable 451 4.4.1 reply: read error from spam.cc.nctu.edu.tw. <mic@cc.nctu.edu.tw>... Deferred: Connection timed out with spam.cc.nctu.edu.tw. <service-ebw@epaper.com.tw>,<service-leon@epaper.com.tw>... Deferred: mail.epaper.com.tw.: No route to host 550 5.1.2 <s93910@mail2.tses.toc.edu.tw>... Host unknown (Name server: mail2.tses.toc.edu.tw: host not found) ... while talking to ccsun41.cc.ntu.edu.tw.: >>> DATA <<< 450 <liwan@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <liwan@ntu.edu.tw>... Deferred: 450 <liwan@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <<< 450 <kunchang@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <kunchang@ntu.edu.tw>... Deferred: 450 <kunchang@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <<< 554 Error: no valid recipients ... while talking to ccsun42.cc.ntu.edu.tw.: >>> DATA <<< 450 <liwan@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <liwan@ntu.edu.tw>... Deferred: 450 <liwan@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <<< 450 <kunchang@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <kunchang@ntu.edu.tw>... Deferred: 450 <kunchang@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <<< 554 Error: no valid recipients ... while talking to ccsun8.cc.ntu.edu.tw.: >>> DATA <<< 450 <liwan@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <liwan@ntu.edu.tw>... Deferred: 450 <liwan@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <<< 450 <kunchang@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <kunchang@ntu.edu.tw>... Deferred: 450 <kunchang@ntu.edu.tw>: Recipient address rejected: Greylisted for 5 minutes <<< 554 Error: no valid recipients ... while talking to smtp.scps.tpc.edu.tw.: >>> DATA <<< 550 5.1.1 <s84195@scps.tpc.edu.tw>... User unknown 550 5.1.1 <s84195@scps.tpc.edu.tw>... User unknown <<< 503 5.0.0 Need RCPT (recipient) ... while talking to mailstp.unitech.com.tw.: >>> RCPT To:<sandy234@unitech.com.tw> <<< 550 Recipient not in route list. 550 5.1.1 <sandy234@unitech.com.tw>... User unknown ... while talking to mx1.mail.tw.yahoo.com.: >>> QUIT <<< 453 Mail from 88.158.10.42 not allowed - [90] ... while talking to mx2.mail.tw.yahoo.com.: >>> QUIT <<< 453 Mail from 88.158.10.42 not allowed - [90] <piro00123@yahoo.com.tw>... Deferred: 453 Mail from 88.158.10.42 (my public ip address) not allowed - [90] Sorry for the lack of more detailes, please tell if you need more. Thank U very much for youre help!!!

[abelio]

source: gxttnaitixdcbw@schmumpf.de destination: cjm@ms.boe.ttct.edu.tw source: emilbtbzonazqjlav@pcfusion.com.au destination:a2783@ms6.hinet.net source: msbfuwagclm@doj.ca.gov destination:yatw@ms32.hinet.net

what ukwizard actually asked was the headers of those emails (' from' and ' to' fields are easily forged); is difficult guess who' s actually sending those emails without headers.

Helo DNS lookup Return e-amil DNS check

try de-activating those checkings to see what happen; are very strict. from docs: " HELO DNS lookup Enable or disable looking up the source domain name (from the SMTP HELO command) in the Domain Name Server Return e-mail DNScheck: Enable or disable checking that the domain specified in the reply-to or from address has an A or MX record."

[#10]

As an update to this problem, it seems that someone is spoofing my public IP addre ss. I have configured rbl and dnsbl lists both on server and Fortigate box but the results are not very promiseing. So I will update my mail server since it' s a bit old and install domaninkeys to see if that will take care of problem completely.