Hi,
I have hMailServer running in an Amazon server. Recently, I ve received a notification by amazon that some of my emails have been marked as spam.
Looking at my SMTP logs I realized several emails have been sent from non existent local accounts to external accounts.
Nevertheless, if I go to hMailServer configuration / advanced / IP Ranges / internet, I can see the checkbox "Local to external e-mail addresses" is ticked on Require SMTP authentication.
So, how can anybody overstep this and be able to send emails through my SMTP server?
How can I prevent this?
I leave here a copy of my log were I am not seeing the server asking for authentication...
"SMTPC" 3148 77658 "2019-11-26 14:31:28.510" "173.194.68.27" "RECEIVED: 220 mx.google.com ESMTP a19si9015162qtd.12 - gsmtp"
"SMTPC" 3148 77658 "2019-11-26 14:31:28.510" "173.194.68.27" "SENT: EHLO mail.enlacemolecular.com.ar"
"SMTPC" 3140 77657 "2019-11-26 14:31:28.510" "173.194.68.27" "RECEIVED: 220 mx.google.com ESMTP t5si7635937qvy.51 - gsmtp"
"SMTPC" 3140 77657 "2019-11-26 14:31:28.510" "173.194.68.27" "SENT: EHLO mail.enlacemolecular.com.ar"
"SMTPC" 3148 77658 "2019-11-26 14:31:28.604" "173.194.68.27" "RECEIVED: 250-mx.google.com at your service, [52.36.70.26][nl]250-SIZE 157286400[nl]250-8BITMIME[nl]250-STARTTLS[nl]250-ENHANCEDSTATUSCODES[nl]250-PIPELINING[nl]250-CHUNKING[nl]250 SMTPUTF8"
"SMTPC" 3148 77658 "2019-11-26 14:31:28.604" "173.194.68.27" "SENT: STARTTLS"
"SMTPC" 3148 77657 "2019-11-26 14:31:28.620" "173.194.68.27" "RECEIVED: 250-mx.google.com at your service, [52.36.70.26][nl]250-SIZE 157286400[nl]250-8BITMIME[nl]250-STARTTLS[nl]250-ENHANCEDSTATUSCODES[nl]250-PIPELINING[nl]250-CHUNKING[nl]250 SMTPUTF8"
"SMTPC" 3148 77657 "2019-11-26 14:31:28.620" "173.194.68.27" "SENT: STARTTLS"
"SMTPC" 3140 77658 "2019-11-26 14:31:28.683" "173.194.68.27" "RECEIVED: 220 2.0.0 Ready to start TLS"
"SMTPC" 3148 77657 "2019-11-26 14:31:28.698" "173.194.68.27" "RECEIVED: 220 2.0.0 Ready to start TLS"
"SMTPC" 3140 77658 "2019-11-26 14:31:28.870" "173.194.68.27" "SENT: EHLO mail.enlacemolecular.com.ar"
"SMTPC" 3148 77657 "2019-11-26 14:31:28.885" "173.194.68.27" "SENT: EHLO mail.enlacemolecular.com.ar"
"SMTPC" 3148 77658 "2019-11-26 14:31:28.948" "173.194.68.27" "RECEIVED: 250-mx.google.com at your service, [52.36.70.26][nl]250-SIZE 157286400[nl]250-8BITMIME[nl]250-ENHANCEDSTATUSCODES[nl]250-PIPELINING[nl]250-CHUNKING[nl]250 SMTPUTF8"
"SMTPC" 3148 77658 "2019-11-26 14:31:28.948" "173.194.68.27" "SENT: MAIL FROM:<margaretpatrizio@enlace-simma.com.ar>"
"SMTPC" 3140 77657 "2019-11-26 14:31:28.964" "173.194.68.27" "RECEIVED: 250-mx.google.com at your service, [52.36.70.26][nl]250-SIZE 157286400[nl]250-8BITMIME[nl]250-ENHANCEDSTATUSCODES[nl]250-PIPELINING[nl]250-CHUNKING[nl]250 SMTPUTF8"
"SMTPC" 3140 77657 "2019-11-26 14:31:28.964" "173.194.68.27" "SENT: MAIL FROM:<dominic.armstrong@enlace-simma.com.ar>"
"SMTPC" 3148 77658 "2019-11-26 14:31:29.026" "173.194.68.27" "RECEIVED: 250 2.1.0 OK a19si9015162qtd.12 - gsmtp"
"SMTPC" 3148 77658 "2019-11-26 14:31:29.026" "173.194.68.27" "SENT: RCPT TO:<theweedjs@gmail.com>"
"SMTPC" 3148 77657 "2019-11-26 14:31:29.057" "173.194.68.27" "RECEIVED: 250 2.1.0 OK t5si7635937qvy.51 - gsmtp"
"SMTPC" 3148 77657 "2019-11-26 14:31:29.057" "173.194.68.27" "SENT: RCPT TO:<marramphotography@gmail.com>"
"SMTPC" 3140 77658 "2019-11-26 14:31:29.167" "173.194.68.27" "RECEIVED: 250 2.1.5 OK a19si9015162qtd.12 - gsmtp"
"SMTPC" 3140 77658 "2019-11-26 14:31:29.167" "173.194.68.27" "SENT: DATA"
"SMTPC" 3148 77658 "2019-11-26 14:31:29.261" "173.194.68.27" "RECEIVED: 354 Go ahead a19si9015162qtd.12 - gsmtp"
"SMTPC" 3148 77658 "2019-11-26 14:31:29.261" "173.194.68.27" "SENT: [nl]."
"SMTPC" 3140 77657 "2019-11-26 14:31:29.261" "173.194.68.27" "RECEIVED: 250 2.1.5 OK t5si7635937qvy.51 - gsmtp"
"SMTPC" 3140 77657 "2019-11-26 14:31:29.261" "173.194.68.27" "SENT: DATA"
"SMTPC" 3124 77657 "2019-11-26 14:31:29.357" "173.194.68.27" "RECEIVED: 354 Go ahead t5si7635937qvy.51 - gsmtp"
"SMTPC" 3124 77657 "2019-11-26 14:31:29.357" "173.194.68.27" "SENT: [nl]."
"SMTPC" 3124 77658 "2019-11-26 14:31:29.449" "173.194.68.27" "RECEIVED: 421-4.7.0 [52.36.70.26 15] Our system has detected that this message is[nl]421-4.7.0 suspicious due to the nature of the content and/or the links within.[nl]421-4.7.0 To best protect our users from spam, the message has been blocked.[nl]421-4.7.0 Please visit[nl]421 4.7.0 https://support.google.com/mail/answer/188131 for more information. a19si9015162qtd.12 - gsmtp"
"SMTPC" 3124 77658 "2019-11-26 14:31:29.449" "173.194.68.27" "SENT: QUIT"
"SMTPC" 3148 77657 "2019-11-26 14:31:29.573" "173.194.68.27" "RECEIVED: 421-4.7.0 [52.36.70.26 15] Our system has detected that this message is[nl]421-4.7.0 suspicious due to the nature of the content and/or the links within.[nl]421-4.7.0 To best protect our users from spam, the message has been blocked.[nl]421-4.7.0 Please visit[nl]421 4.7.0 https://support.google.com/mail/answer/188131 for more information. t5si7635937qvy.51 - gsmtp"
"SMTPC" 3148 77657 "2019-11-26 14:31:29.573" "173.194.68.27" "SENT: QUIT"
Require SMTP authentication
Re: Require SMTP authentication
SMTPD is your server receiving the message
SMTPC is your server sending the message to another server
BEFORE that log snippet, the message will be received by your server somehow. Show that earlier part of the logs
ALSO, run this and post the results
viewtopic.php?f=20&t=30914
SMTPC is your server sending the message to another server
BEFORE that log snippet, the message will be received by your server somehow. Show that earlier part of the logs
ALSO, run this and post the results
viewtopic.php?f=20&t=30914
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation