Does this email suggest a vulnerability in my mail server?

–-----------Full text of email------------

Return-Path: <>



Received: from billgates (unknown [])

by (Postfix) with SMTP id 842104C55

for <>; Fri, 16 Jun 2006 03:12:31 -0400 (EDT)

Message-Id: <>

Date: Fri, 16 Jun 2006 03:12:31 -0400 (EDT)


To: undisclosed-recipients:;


–-------------End email ------------------


Jun 16 03:12:27 www postfix/smtpd[17493]: connect from unknown[]

Jun 16 03:12:32 www postfix/smtpd[17493]: 842104C55: client=unknown[]

Jun 16 03:12:34 www postfix/cleanup[17496]: 842104C55: message-id=<>

Jun 16 03:12:34 www postfix/qmgr[24375]: 842104C55: from=<>, size=340, nrcpt=1 (queue active)

Jun 16 03:12:34 www postfix/local[17497]: 842104C55: to=<>, relay=local, delay=3, status=sent (delivered to command: procmail -a "$EXTENSION")

Jun 16 03:12:34 www postfix/qmgr[24375]: 842104C55: removed

Jun 16 03:12:35 www postfix/smtpd[17493]: disconnect from unknown[]

We use postfix and pop-before-smtp.

user DPmkV is not a valid user on User DPmkV should, therefore, not be able to send from User realuser is a valid user on If this went through some other mailserver, realuser would necessarily receive it.

I cannot tell if there is a threat at hand or if the From: and Return-Path: are simply spoofed. Any ideas? Obviously if we've got a hole, I want to close it.


1 Reply

This looks to me like SPAM. This person took advantage of the fact you must deliver mail to local users or they would never receive any mail. By connecting to your server directly and addressing the user they didn't have to worry about finding a server open to relaying.

So I don't think it's a hole. IMO it wouldn't be worth the overhead to do additional checking such cross checking valid From: to real users. It would solve the problem until the spammer started sending mail with From: and To: as the same address.

It's also possible that this is the realuser who wanted to send an email to themself, had no relay server available to them, was too lazy to type their name in the From: box.


Please enter an answer

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct