Spam on new unused server

Easy; someone just connected to your SMTP server at random and submitted a spam message addressed to root. The fact that you haven't pointed an MX record toward it just means that you won't get spam pointed toward @whateveryouhave.tld. Anyone can still connect to port 25 on your server and attempt to submit mail.

See this thread for some generic recommendations on setting up Postfix.

Note: don't be tempted to block or bit-bucket mail with a null sender <>; some valid mail will come from this address.

Awesome thanks!

Can you answer a couple follow ups?

1. I considered the "just sending to root" deal, and tried that myself to see if it would (somehow) end up in my test@example.com inbox, and it didn't. So how did the message sent to root end up in test@example.com, when my text message did not replicate the same thing?

2. Reading the linked forum sounds like I can possible use the "rejectunlistedrecipient"? Or would root be listed? If so, how can I disable root from getting mail, or is this a bad thing to do?

An MX record is not necessary to receive mail if the A record for yourdomain.com points to an IP that is configured to handle mail for your domain.

I think Vance was on the right track.

I receive no other mail to that address, as far as the world is concerned, it doesn't exist via it's domain, only IP.

I can't really give answers to your questions not knowing your specific configuration, but I can try to give you some hints.

1. Somehow Postfix has been configured to take (some) mail addressed to root and deliver it to test@example.com. This could be in /etc/aliases, your virtual alias config, or your virtual mailbox config. I would guess it's one of the latter two, since it seems to be treating mail differently based on whether it's submitted locally or externally.

2. Yes, root is probably considered "listed" although this depends on your exact configuration (see especially the values for localrecipientmaps, virtualaliasmaps, virtualmailboxmaps, relaydomains). Cron jobs and many daemons expect to be able to send mail to root in case of trouble, so disabling it is probably not a good idea. I would suggest making sure that delivery is working properly to all the addresses you'd like to receive mail before using rejectunlisted_recipient.

In short, the best way to prevent root from getting spam is to set up your mail server so that all recipients get a minimum of spam. In descending order of my personal preference, methods to do this include the Postfix sanity checks, greylisting, DNSBLs, and content filtering (Spamassassin). You don't want to put super-duper filtering on mail to root (and may in fact want less), since when things go wrong, that's probably where the notification is going. You may be throwing that notification away if you're too aggressive on filtering.

Alrighty, thanks for the tips! :) Have a great day.

If you post you postfix configuration, troubleshooting would be easier…

Sure thing.

Here is my main.cf

# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = PcComputerGuy.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $mydomain, localhost.$mydomain, localhost
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,reject_unlisted_recipient

Here is my master.cf

#
# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       -       -       -       smtpd
465       inet  n       -       n       -       -       smtpd

#submission inet n       -       -       -       -       smtpd
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#smtps     inet  n       -       -       -       -       smtpd
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#628       inet  n       -       -       -       -       qmqpd
pickup    fifo  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
#qmgr     fifo  n       -       -       300     1       oqmgr
tlsmgr    unix  -       -       -       1000?   1       tlsmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       -       -       -       smtp
dovecot   unix  -       n       n       -       -       pipe
    flags=DRhu user=REMOVED:REMOVED argv=/usr/lib/dovecot/deliver -d ${recipient}
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay     unix  -       -       -       -       -       smtp
    -o smtp_fallback_relay=
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
retry     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       -       -       -       lmtp
anvil     unix  -       -       -       -       1       anvil
scache    unix  -       -       -       -       1       scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=REMOVED argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
#  mailbox_transport = lmtp:inet:localhost
#  virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus     unix  -       n       n       -       -       pipe
#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix  -       n       n       -       -       pipe
#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix    -   n   n   -   2   pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}

Here is my Dovecot.conf

protocols = imap imaps pop3 pop3s

disable_plaintext_auth = no

log_path = /var/log/dovecotErrors

info_log_path = /var/log/dovecotInfo

log_timestamp = "%Y-%m-%d %H:%M:%S "

mail_location = maildir:/var/vmail/%d/%n/Maildir 

namespace private {

}

mail_privileged_group = mail

protocol imap {

}

protocol pop3 {

  pop3_uidl_format = %08Xu%08Xv

}

protocol managesieve {
}

protocol lda {
    log_path = /var/vmail/dovecot-deliver.log
    auth_socket_path = /var/run/dovecot/auth-master
    postmaster_address = MyEmailAddressRemoved
    # mail_plugins = cmusieve
    mail_plugins = sieve

}

auth default {

  mechanisms = plain login

  passdb sql {
    # Path for SQL configuration file
    args = /etc/dovecot/dovecot-sql.conf
   }

  # LDAP database 
  #passdb ldap {
    # Path for LDAP configuration file
    #args = /etc/dovecot/dovecot-ldap.conf
  #}

  userdb passwd {

  }

  # passwd-like file with specified location
  # 
  #userdb passwd-file {
    # [username_format=<format>] <path for="" passwd-file="">#args =
  #}

  # checkpassword executable user database lookup
  # 
  #userdb checkpassword {
    # Path for checkpassword binary
    #args = 
  #}

  # static settings generated from template 
  userdb static {

    args = uid=5000 gid=5000 home=/var/vmail/%d/%n allow_all_users=yes

  }

  # SQL database 
  #userdb sql {
    # Path for SQL configuration file
    #args = /etc/dovecot/dovecot-sql.conf
  #}

  # LDAP database 
  #userdb ldap {
    # Path for LDAP configuration file
    #args = /etc/dovecot/dovecot-ldap.conf
  #}

  # vpopmail 
  #userdb vpopmail {
  #}

  user = root

  # It's possible to export the authentication interface to other programs:
  socket listen {
    master {

      path = /var/run/dovecot/auth-master
      mode = 0600
      user = REMOVED
    }
    client {

      path = /var/spool/postfix/private/auth
      mode = 0660
      user = REMOVED
      group = REMOVED
    }
  }
}

dict {
  #quota = mysql:/etc/dovecot/dovecot-dict-quota.conf
  #expire = db:/var/lib/dovecot/expire.db
}

plugin {

}</path></format> 

Thanks!