Spam email going to alias, which is being bounced and forwarded...
Question asked by echoDreamz - 3/24/2017 at 11:17 AM
[2017.03.24] 11:56:44 [10229] Delivery started for at 11:56:44 AM
[2017.03.24] 11:56:47 [10229] Starting local delivery to account_does_not_exist@domain
[2017.03.24] 11:56:47 [10229] recipient account_does_not_exist@domain does not exist.  Message directed to the domains catchall.
[2017.03.24] 11:56:47 [10229] Delivery for to account_does_not_exist@domain has completed (Deleted) Filter: None
[2017.03.24] 11:56:47 [10229] End delivery to account_does_not_exist@domain
[2017.03.24] 11:56:50 [10229] Starting local delivery to
[2017.03.24] 11:56:50 [10229] Bounce email written to 73810268.eml
[2017.03.24] 11:56:50 [10229] Delivery for to has completed (Bounced)
[2017.03.24] 11:56:50 [10229] Delivery for to has completed (Bounced)
[2017.03.24] 11:56:50 [10229] Starting local delivery to
[2017.03.24] 11:56:50 [10229] Delivery for to has completed (Deleted) Filter: Spam (Weight: 85), Action (Global Level): Delete
[2017.03.24] 11:56:50 [10229] End delivery to
[2017.03.24] 11:56:50 [10229] Delivery finished for at 11:56:50 AM	[id:x73810229]
The message is spam, weight 85 which they have set to delete. The spammer sends to a non-existent account which gets forwarded to their catch all, which is an alias. The alias forwards to a account and a local (same domain) account. The forward to the local domain account is deleted per their spam settings like it should.
However the forward to the address attempts to send, however the account does not exist, which results in a bounce notice ending up in our spool back to the spammer. We do have SMTP outbound blocking set to stop outgoing emails that have a high score, but in this case, it does not seem to matter.
Obviously removing the invalid address will fix this, but I am curious as to why SmarterMail is even attempting to forward an email that is above our "do not forward spam an above" settings.

Reply to Thread