Spam Protection

[Sitepoint]

Hi,

a client of mine has been spammed by email, preventing to be send by himself.
As I see, the sender of the mail comes from a blacklisted ip. So I asked myself, how is it possible or what did i configured wrong, that this could be happen.

Here is the header of the mail:

Code: Select all

Received: from ([127.0.0.1]) with MailEnable ESMTP; Thu, 26 Jun 2014 14:54:20 +0200
Received: from [186.113.28.19] ([186.113.28.19])
	by PE-SitePoint5 ([62.112.132.25], envelope-sender=<willkommen@wilde-ente.de>)
	with SMTP (CleanMail 5.5.1.1); Thu, 26 Jun 2014 14:54:07 +0200
Date: 26 Jun 2014 01:38:47 -0600
From: <willkommen@wilde-ente.de>
X-Priority: 3
Message-ID: <894784668.201406260155@wilde-ente.de>
To: <willkommen@wilde-ente.de>
Subject: Brauchen Sie das Geld, lernen Sie zu verdienen!
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----------27F804C8C9DB340"
X-CleanMail-Result: Passed (Whitelist)
X-CleanMail-HeloName: [186.113.28.19]
X-CleanMail-HostIP: 186.113.28.19
X-CleanMail-MessageID: 53AC17EF0002006B
X-CleanMail-Policy: accept/deliver (whitelisted)
X-CleanMail-Port: SMTP Proxy
Return-Path: <willkommen@wilde-ente.de>
X-Read: 1

Any ideas?

Thanks for your time and support



Tom

[MailEnable-Ian]

Hi,

Do you have SMTP reverse DNS blacklisting enabled? And which blacklist have you enabled? What are you using to determine the incoming IP was blacklisted? Perhaps you need to enable SMTP "Address Spoofing" security and set the option to "Authenticated senders can spoof the sender address". This will enforce local senders that are sending to other locally hosted addresses to authenticate and prevent the spammer from spoofing the FROM address.

[Sitepoint]

Hi,

thanks for your quick reply.
I'm using Spamcop and SpamhausZEN.

Address Spoofing Prevention was already set to "Authenticated users can spoof sender addresses".

The setting for reverse DNS blacklisting I could not found. Where can I check that?

Best regards -


Tom

[MailEnable-Ian]

Hi,

If you are using Spamcop and SpamhausZEN as blacklist look ups then I would presume that you have enabled Reverse DNS blacklisting.

[Sitepoint]

Hi,

I cannot find the option "enabled Reverse DNS blacklisting".
I have the Enterprise Premium Edition 8.51.
My settings for Blacklist I have attached.

[MailEnable-Ian]

Hi,

http://www.mailenable.com/documentation ... sting.html

[Sitepoint]

Hi,

thanks again for your answer."Enable DNS blacklisting" is already activated, but my customer still gets mail from himself.
Do I have to activate "Enable URL Blacklisting" too or is it not wise to have both enabled at the same time.


Best regards -


Tom