While looking in my sent folder of my MIAB server I noticed an email message that I never sent. It clearly looks like SPAM and I am very keen to figure out where it came from. The message headers do not look like it went through my mail system and the from/to appear to be from me:
From: Chris chris@dscoduc.com
X-Pgp-Agent: GPGMail 2.6b2
Content-Type: multipart/signed;
boundary=“Apple-Mail=_507982D1-C5A9-4410-8652-A82ED8B063F3”;
protocol=“application/pgp-signature”; micalg=pgp-sha512
X-Smtp-Server: ECBBFB7E-6F8B-4B18-B12F-65098689AAED
Subject: Fwd: Trust me, this will cure your DIABETES!
Date: Thu, 21 Apr 2016 13:44:16 -0700
X-Universally-Unique-Identifier: ABD4CB32-FF97-4E82-8A16-E980F66EA76E
References: 20160422043224.1F901A83821C1B7C@dscoduc.com
To: chris@dscoland.com
Message-ID: B350D018-E984-4A27-8F24-A9273AA4771F@dscoduc.com
MIME-Version: 1.0
–Apple-Mail=_507982D1-C5A9-4410-8652-A82ED8B063F3
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
charset=us-ascii
Looking at the header information it clearly came from my Mac mail client since I have PGP configured to attach a signature with all outgoing email… I also don’t recognize the server header
X-Smtp-Server: ECBBFB7E-6F8B-4B18-B12F-65098689AAED
Looking at the output from mxtoolbox.com it seems I am not an open relay:
Connecting to 198.101.242.122
220 box.epiphyte.xyz ESMTP Postfix (Ubuntu) [1939 ms]
EHLO PWS3.mxtoolbox.com
250-box.epiphyte.xyz
250-PIPELINING
250-SIZE 134217728
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN [609 ms]
MAIL FROM:supertool@mxtoolbox.com
250 2.1.0 Ok [672 ms]
RCPT TO:test@example.com
554 5.7.1 test@example.com: Relay access denied [828 ms]
Does anyone know what’s going on here?