anonymous@domainname.tld

[futureweb]

anonymous@domainname.tld - Spam Problem

Hello,

lately we get lots of Spam over anonymous@domainname.tld - which apears to be automatically forwarded to the Plesk Server Admin.
How can I deactivate this behaviour?

[root@server plesk]# strings virtual.db | grep anonymous@domainname.tld
anonymous@domainname.com
anonymous@domainname.info
anonymous@domainname.de
anonymous@domainname.it
anonymous@domainname.at
anonymous@domainname.eu
anonymous@domainname.co.at
anonymous@domainname.or.at

Thank you
Andreas Schnederle-Wagner

 

[SteveL132]

I am not sure I understand. Is it just that spammers are sending emails to user "anonymous" on your domain, which doesn't exist? Under "Mail Settings" for your domain (not the server) you can say what to do with mail to nonexistent users.

 

[futureweb]

I am not sure I understand. Is it just that spammers are sending emails to user "anonymous" on your domain, which doesn't exist? Under "Mail Settings" for your domain (not the server) you can say what to do with mail to nonexistent users.

Hi Steve,

yes - we receive lot's of Spam at those anonymous@dom.tld Mail Adresses - they are NOT set up for that Domain AND the Domain where this happens is configured to DENY non existant E-Mail Addresses.
But I can send Mails to this non existant Mail Address and they get delivered to the Server Admin Mail Address?!?

Andreas

 

[SteveL132]

First of all, the "To" field that is displayed in emails is not where it gets delivered. There's a hidden "envelope" set of values in the SMTP protocol that indicate the actual addressee. Are you sure that the emails you send aren't just getting delivered to you as undeliverable?

Depending on which SMTP server you are running (usually Postfix) you can look at the server log (see http://kb.parallels.com/en/111283) and see what the server is doing. You might want to do a DNS lookup (I use http://centralops.net/co/ for this) of the domain in question (I assume it isn't actually dom.tld) and look to see what MX servers it has defined.

My guess is that the SMTP envelope specifies a valid address on your domain. You might see a clue by examining the headers of a received email, but this is not guaranteed.

 

[futureweb]

well - here is the relevant part of the Log - anonymous@tld.com will be sent to anonymous@localhost.localdomain - which finally lands in Server Admins Mailbox ...
Same behaviour for all Domains which are set up on this Plek Server

If I send to "xyz@tld.com" it normally bounces with "user unknown" - as configured ... ?!

Jun 4 11:09:28 kdn7 postfix/smtpd[25462]: connect from eu1sys200amx134.postini.com[207.126.144.223]
Jun 4 11:09:28 kdn7 postfix/qmgr[29781]: 2D57AC10E4A: from=<schnederle@futureweb.at>, size=6318, nrcpt=1 (queue active)
Jun 4 11:09:28 kdn7 postfix/smtpd[25455]: D5B2AC10ABC: client=eu1sys200amx137.postini.com[207.126.144.226]
Jun 4 11:09:28 kdn7 postfix/cleanup[24423]: D60B0C11022: message-id=<182e03d128384d0fb9db772f07b40dcc@futureweb.at>
Jun 4 11:09:28 kdn7 postfix/smtpd[25452]: disconnect from eu1sys200amx140.postini.com[207.126.144.229]
Jun 4 11:09:28 kdn7 postfix/local[25294]: 2D57AC10E4A: to=<anonymous@localhost.localdomain>, orig_to=<anonymous@tld.com>, relay=local, delay=0.73, delays=0.72/0/0/0.01, dsn=2.0.0, status=sent (forwarded as D60B0C11022)
Jun 4 11:09:28 kdn7 postfix/qmgr[29781]: 2D57AC10E4A: removed
Jun 4 11:09:28 kdn7 postfix/qmgr[29781]: D60B0C11022: from=<schnederle@futureweb.at>, size=6479, nrcpt=1 (queue active)
Jun 4 11:09:28 kdn7 postfix/smtpd[25462]: E9DD9C10E4A: client=eu1sys200amx134.postini.com[207.126.144.223]

Same behaviour as anonymous@ for some other Mail Addresses: root@, postmaster@, mailer-daemon@, kluser@, drweb@ - those are all forwarded to Server Admin - all of them are present in the virtual.db (strings virtual.db) even if they are NOT set up within Plesk ...

 

[futureweb]

according to this - those standard Accounts are always created when a new Domain is set up within Plesk ... and Mails to those Addresses are delivered to Server Admin ...
http://kb.parallels.com/en/6129

During creation of the new domain, domain.tld, in Parallels Plesk Panel, the following mail aliases are created by default:

~# postmap -s /var/spool/postfix/plesk/virtual | grep domain.tld
mailer-daemon@domain.tld mailer-daemon@localhost.localdomain
anonymous@domain.tld anonymous@localhost.localdomain
postmaster@domain.tld postmaster@localhost.localdomain
root@domain.tld root@localhost.localdomain

No way to deactivate this dumb behaviour?!?!

Andreas

 

[SteveL132]

How fascinating. I see I have these same aliases on my domain, yet I'm not sure where mail to them gets delivered as when I send mail to them, nothing shows up in my server admin mailbox. I have a theory about that which is not relevant to your problem...

Some of these aliases are "required" by ICANN conventions, such as postmaster. I don't know about the others.

localhost.localdomain is required to be defined as a fully qualified domain name that translates to 127.0.0.1 (that is, your local host system.) I found http://kb.parallels.com/en/6129 that discusses these email aliases in the context of a fix to an earlier version of Plesk. It isn't of direct interest but it does suggest some background. I can find lots of discussion of mail that is sent from these addresses, but little on what is supposed to happen to mail sent to them. It may be that you just have to deal with them as spam. Perhaps someone else will have an insight.

 

[H9k]

I have the same issue, and it is quite annoying. Not only anonymous@ but also root@ and drweb@ are affected. All get forwarded to my root mailbox.