Mailcow-dockerized: Can you track down who is sending out spam through mailcow UI?

[tamerax]

Is there anyway to use the UI to "easily" isolate which domain/account would be sending out spam emails?
My IP has been blacklisted a few times now and while the first time it was obvious as a machine was hacked and I dropped/deleted that client but this time around, I can't isolate who might be doing it as it's less obvious. I think the volume is much lower but it still keeps happening.

Any suggestions?

[ntimo]

You could take a look at the rspamd log to find out who send the spam :)

[andryyy]

Are you hosting people you don't know? :o

Is your mailq empty? docker-compose exec postfix-mailcow mailq

You can also set a ratelimit on domains you don't trust. Enable watchdog-mailcow to be notified when they hit a ratelimit.

There is a "Ratelimit" tab in the logs somewhere, too.

Are you sure you are delisted and then listed, again? Or have you just not been delisted completely?

[tamerax]

I know all the clients on my server now. The only one I was questioning turned out to the one I had an issues with a few months ago and they are gone.

I will def use the rate limit function to help narrow down who might be the culprit. Thank you for the suggestion.

I will also monitor the rspamd log.

Basicly I got listed with Hotmail for some reason and they have a long delisting procedure, if they even reply so I swapped ips. The new ip was apparently ALREADY on the hotmail blacklist and I sent them stuff about that and they are investigating. This was 2 days ago. This morning, I got on the office365 blacklist somehow so something is up. Not showing up on any other lists though. :(

[andryyy]

You can ask them to delist your IP somewhere.

You don’t host on OVH? Or one of its siblings. SoYouStart etc.

[tamerax]

I do host on OVH :(

[ro78]

You are not guilty, a huge range of their IP addressed have been blacklisted by Microsoft. There are a lot of complaints from OVH customers on their mailing list.

[andryyy]

OVH is the worst to host mail on. :/ Very wurstig.

[tamerax]

what about digital ocean or AWS? The upside to OVH is that they bill me in Canadian funds as opposed to other places in the same price range so it's cheaper.

[andryyy]

AWS has closed SMTP ports afaik.

DO closes outgoing 25/tcp over v6.

[jjkondrat]

I have mailcow running successfully on AWS for over a year, you just have to make sure you fill out the following form so you're not rate limited and have a reverse static DNS entry:
https://aws.amazon.com/forms/ec2-email-limit-rdns-request?catalog=true&isauthcode=true

Also need to make sure on the AWS side have all your security groups (inbound/outbound ports) and an elastic IP setup so your public IP doesn't change.
Plus you want to make sure you have all your DNS records setup properly at your domain provider.

I was able to get a free (mostly) year out of AWS since i kept it on a small instance without a lot of heavy traffic. I did pay a small fee for extra storage for backups I'd make every 2 weeks.

I also spent a lot of time making sure DKIM/DMARC was setup properly so spoofing my domains was harder to do.

I'm happy to try to provide any more info if you decided to try out AWS.

[tankerkiller125]

@andryyy I actually have not had an issue with port 25 on IPv6 being blocked by digital ocean. I'll have to double check but it seems to be working as expected since I am receiving emails with an IPv6 address in the headers.

[andryyy]

Outgoing. :)

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.