I'm not an admin, I just created a website, and there's also a mail server on the server I payed for from my hosting provider. Most for what I learnt about mail servers is from an internet tutorials.
I'm using Open Panel (with Postfix), because I failed with configuring Exim properly. But my problems haven't come to an end.
Now I can see that my mail server probably (?) is being used by someone else, because in the /var/log/mail.log file I can see a lot of unknown email adresses, things like:
postfix/smtp: C1EF776612: to=<[email protected]>, relay=mail2.gieprod.com[22.214.171.124]:25, delay=21527, delays=21525/0.01/1.8/0, dsn=4.0.0, status=deferred (host mail2.gieprod.com[126.96.36.199] refused to talk to me: 554-mail2.gieprod.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
postfix/smtpd: NOQUEUE: reject: RCPT from smtp-sortant.sn.auf.org[188.8.131.52]: 550 5.1.1 <EmmanuelRoy@mydomain>: Recipient address rejected: User unknown in virtual mailbox table; from=<> to=<EmmanuelRoy@mydomain> proto=ESMTP helo=<smtp-sortant.sn.auf.org>
Does the last one means it ok, or it means something else?
These are not mine emails. And there's a lot of them, and their "RCPT TO" command usually takes 20 email adresses as I see in the log. Sometimes there appears "Throttling" (?) sentence. And they are using my domain name for many different fake email adresses as "MAIL FROM", e.g. chevassucathy@mydomain, AKZwart@mydomain, MichaelLESKINEN@mydomain, SantinaZappulla@mydomain and lots of others.
Yesterday evening I've used this to clear a queue for emails (I just learnt that there's something like a queue):
postsuper -d ALL
But today morning I can see that there are new not sent emails in a queue.
So, I wonder if I could restrict somehow using of SMTP on my server, like perhaps:
- I could restrict using SMTP from outside (non-local) to only determined IP numbers?
- I could not allow to send any other email adresses as "MAIL FROM" than related to the emails accounts existing (set up)?
- other ways?
Or, am I only able to prevent this by stopping SMTP service, and launching postfix when I actually want to send an email (very uncomfortable of course)?
EDIT: I tried to do a test on this site: http://www.aboutmyip.com/AboutMyXApp/QuickServerTest.jsp
Here's what I got:
>>> 220 name ESMTP Postfix (Debian/GNU) <<< EHLO u16544016.aboutmyip.com >>> 250-name >>> 250-PIPELINING >>> 250-SIZE 10240000 >>> 250-VRFY >>> 250-ETRN >>> 250-STARTTLS >>> 250-AUTH PLAIN LOGIN >>> 250-ENHANCEDSTATUSCODES >>> 250-8BITMIME >>> 250 DSN <<< MAIL FROM: >>> 250 2.1.0 Ok <<< RCPT TO: >>> 554 5.7.1 : Recipient address rejected: Relay access denied <<< QUIT Connection test: PASS Reverse IP Lookup: WARNING - Reverse IP lookup test failed on your server. Some servers on the Internet may reject emails from this server. Open relay test: PASS
I thought that this is an authentication - this is a content of the /etc/postfix/sasl/smtpd.conf file:
pwcheck_method: authdaemond log_level: 3 mech_list: PLAIN LOGIN authdaemond_path: /var/run/courier/authdaemon/socket
The SMTP server when I telnet to it seem to require e.g. to pass "auth plain [base64 with email adress and pswd]" in order to use "MAIL TO" command.