We upgraded from version 15 to version 16 a couple of days ago. Shortly after upgrading we got a number of complaints that mails were not being received from clients which they had never had issues with in the past.
I looked through the logs and saw that the NULL Sender rule was being triggers as well as the SPF Fail for an alarmingly large amount of mail. In the logs I could clearly see the senders email address so I'm confused as to why the NULL Sender rule if triggered.
I looked up one of the domain which was continuously failing the NULL Sender and SPF rules and this domain used outlook.com as their mail server to relay mail so I'm guessing it’s not related to a server being miss configured?
I don’t know much about this new rule but I'd like to learn more and find out why I'm seeing so may failures on NULL Sender when the sending domain is clearly visible to me in the logs.
Below is an example.
----------------------------------------------------------------------------------------
[2017.12.04] 13:14:43 [07837] Delivery started for pa@XXXXXXXXXXdesign.co.za at 1:14:43 PM
[2017.12.04] 13:15:06 [07837] Message exceeds maximum scanning size, skipping content based checks.
[2017.12.04] 13:15:07 [07837] Spam check results: [_REVERSEDNSLOOKUP: passed], [_NULLSENDER: failed], [_COMMTOUCH: 0,Unknown], [_SPF: Fail], [_DK: None], [_DKIM: Pass], [BACKSCATTER: passed], [BARRACUDA: passed], [BONDEDSENDER: passed], [CBL: passed], [CBL - ABUSE SEAT: passed], [DNSBL: passed], [GBUDB: passed], [HOSTKARMA-BLACK: passed], [HOSTKARMA-YELLOW: passed], [IADB: passed], [IX: passed], [MAILSPIKE-H1: passed], [MAILSPIKE-H2: failed], [MAILSPIKE-H3: passed], [MAILSPIKE-H4: passed], [MAILSPIKE-H5: passed], [MAILSPIKE-L1: passed], [MAILSPIKE-L2: passed], [MAILSPIKE-L3: passed], [MAILSPIKE-L4: passed], [MAILSPIKE-L5: passed], [MCAFEE: passed], [MSRBL: passed], [NSZONES: passed], [SEM-5: passed], [SEM-BL: passed], [SEM-BS: passed], [SEM-URIBL: passed], [SEM-URIRED: passed], [SENDERSCORE: passed], [SORBS: passed], [SORBS-NEW: passed], [SORBS-NOMAIL: passed], [SORBS-RECENT: passed], [SPAMCOP: passed], [SPAMHAUS - PBL 1: passed], [SPAMHAUS - SBL 1: passed], [SPAMHAUS - XBL 1: passed], [SPAMHAUS - ZEN: passed], [SPAMHAUS-UCE PROTECT LEVEL 1: passed], [SPAMHAUS-UCE PROTECT LEVEL 2: passed], [SPAMHAUS-UCE PROTECT LEVEL 3: passed], [SPAMRATS: passed], [SURBL: passed], [SURRIEL: passed], [UBL: passed], [UCEPROTECT-1: passed], [UCEPROTECT-2: passed], [UCEPROTECT-3: passed], [URIBL-BLACK: passed], [URIBL-GREY: passed], [URIBL-WHITE: passed], [ZEN: passed]
[2017.12.04] 13:15:08 [07837] Starting local delivery to ksunpath@XXXXXXXXXXXXran.co.za
[2017.12.04] 13:15:08 [07837] Delivery for to ksunpath@XXXXXXXXXXXran.co.za has completed (Deleted) Filter: Spam (Weight: 38), Action (Global Level): Delete
[2017.12.04] 13:15:08 [07837] End delivery to ksunpath@XXXXXXXXXXran.co.za
[2017.12.04] 13:15:08 [07837] Starting local delivery to accounts@XXXXXXXXXXXran.co.za
[2017.12.04] 13:15:08 [07837] Delivery for to accounts@XXXXXXXXXXran.co.za has completed (Deleted) Filter: Spam (Weight: 38), Action (Global Level): Delete
[2017.12.04] 13:15:08 [07837] End delivery to accounts@XXXXXXXXXXXXran.co.za
[2017.12.04] 13:15:08 [07837] Delivery finished for at 1:15:08 PM [id:59823607837]
----------------------------------------------------------------------------------------
Thanks, Pat