如何彻底阻止中继外来域邮件（附日志）
我的MDaemon中“安全”选项里已经设置了禁止中止外来域邮件，可是仍然发现有非本公司域的邮件冒充本公司某个邮箱往外发，这种情况是怎么回事？请看以下日志：（其中XXX.XXX.XXX.XXX是公司IP地址，XXXX.com是公司域名）
Sat 2010-05-29 05:23:33: Session 1014; child 1
Sat 2010-05-29 05:23:32: Parsing Message <e:\mdaemon\queues\remote\pd35000893991.msg>
Sat 2010-05-29 05:23:32: From: flr@ioty.net
Sat 2010-05-29 05:23:32: To: zxf_1969@163.com
Sat 2010-05-29 05:23:32: Subject: =?GB2312?B?zOG5qdfu0MKzycGitcTG89K1w/u1pQ==?=
Sat 2010-05-29 05:23:32: Message-ID: <20100529053653.07D4F2B913@sxdiptz.net>
Sat 2010-05-29 05:23:32: 的 MX-record 解析已在进行(DNS 服务: 202.106.196.115)...
Sat 2010-05-29 05:23:32: *P=050 D=163.com TTL=(51) MX=
Sat 2010-05-29 05:23:32: *P=010 D=163.com TTL=(51) MX=
Sat 2010-05-29 05:23:32: *P=010 D=163.com TTL=(51) MX=
Sat 2010-05-29 05:23:32: *P=010 D=163.com TTL=(51) MX=
Sat 2010-05-29 05:23:32: *P=010 D=163.com TTL=(51) MX=
Sat 2010-05-29 05:23:32: Attempting MX: P=010 D=163.com TTL=(51) MX=
Sat 2010-05-29 05:23:32: 正在试图 SMTP 连接到
Sat 2010-05-29 05:23:32: A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Sat 2010-05-29 05:23:32: D=163mx01.mxmail.netease.com TTL=(3) A=
Sat 2010-05-29 05:23:32: 正在试图 SMTP 连接到
Sat 2010-05-29 05:23:32: 等候 socket 连接...
Sat 2010-05-29 05:23:32: Socket 连接建立(XXX.XXX.XXX.XXX : 4398 -> 220.181.12.53 : 25)
Sat 2010-05-29 05:23:32: 等候协议初始化...
Sat 2010-05-29 05:23:33: <-- 220 163.com Anti-spam GT for Coremail System (163com)
Sat 2010-05-29 05:23:33: --> EHLO XXXX.com
Sat 2010-05-29 05:23:33: <-- 250-mail
Sat 2010-05-29 05:23:33: <-- 250-PIPELINING
Sat 2010-05-29 05:23:33: <-- 250-AUTH LOGIN PLAIN
Sat 2010-05-29 05:23:33: <-- 250-AUTH=LOGIN PLAIN
Sat 2010-05-29 05:23:33: <-- 250-coremail 1Uxr2xKj7kG0xkI17xGrU7I0s8FY2U3Uj8Cz28x1UUUUU7Ic2I0Y2UrVefvjUCa0xDrUUUUj
Sat 2010-05-29 05:23:33: <-- 250 8BITMIME
Sat 2010-05-29 05:23:33: --> MAIL From:<abc@XXXX.com>
Sat 2010-05-29 05:23:33: <-- 250 Mail OK
Sat 2010-05-29 05:23:33: --> RCPT To:<zxf_1969@163.com>
Sat 2010-05-29 05:23:33: <-- 250 Mail OK
Sat 2010-05-29 05:23:33: --> DATA
Sat 2010-05-29 05:23:33: <-- 354 End data with <CR><LF>.<CR><LF>
Sat 2010-05-29 05:23:33: 正在发送 <e:\mdaemon\queues\remote\pd35000893991.msg> 到
Sat 2010-05-29 05:23:33: 发送完成。
Sat 2010-05-29 05:23:33: <-- 250 Mail OK queued as mx3,NcCowKD7b_QFNwBM061rAA--.1756S2 1275082502
Sat 2010-05-29 05:23:33: --> QUIT
Sat 2010-05-29 05:23:33: <-- 221 Bye
Sat 2010-05-29 05:23:33: SMTP 连接成功完成(字节入/出: 378/3830)
Sat 2010-05-29 05:23:33: ----------
Sat 2010-05-29 08:15:17: Session 1138; child 1
Sat 2010-05-29 08:15:17: Parsing Message <e:\mdaemon\queues\remote\pd35000893993.msg>
Sat 2010-05-29 08:15:17: From: ciotzfkq@wchntyd.com.tw
Sat 2010-05-29 08:15:17: To: jianhua_91@126.com
Sat 2010-05-29 08:15:17: Subject: =?GB2312?B?zqrE48zhuakwOS0xMMTq1+7QwrmkyczXorLhtcS5q8u+w/vCvA==?=
Sat 2010-05-29 08:15:17: Message-ID: <20100529082841.07D4F2B468@sydjpuz.com>
Sat 2010-05-29 08:15:17: 的 MX-record 解析已在进行(DNS 服务: 202.106.196.115)...
Sat 2010-05-29 08:15:17: *P=050 D=126.com TTL=(59) MX=
Sat 2010-05-29 08:15:17: *P=010 D=126.com TTL=(59) MX=
Sat 2010-05-29 08:15:17: *P=010 D=126.com TTL=(59) MX=
Sat 2010-05-29 08:15:17: Attempting MX: P=010 D=126.com TTL=(59) MX=
Sat 2010-05-29 08:15:17: 正在试图 SMTP 连接到
Sat 2010-05-29 08:15:17: A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Sat 2010-05-29 08:15:17: D=126mx01.mxmail.netease.com TTL=(6) A=
Sat 2010-05-29 08:15:17: 正在试图 SMTP 连接到
Sat 2010-05-29 08:15:17: 等候 socket 连接...
Sat 2010-05-29 08:15:17: Socket 连接建立(XXX.XXX.XXX.XXX : 1059 -> 220.181.15.134 : 25)
Sat 2010-05-29 08:15:17: 等候协议初始化...
Sat 2010-05-29 08:15:17: <-- 220 126.com Anti-spam GT for Coremail System (126com)
Sat 2010-05-29 08:15:17: --> EHLO XXXX.com
Sat 2010-05-29 08:15:17: <-- 250-mail
Sat 2010-05-29 08:15:17: <-- 250-PIPELINING
Sat 2010-05-29 08:15:17: <-- 250-AUTH LOGIN PLAIN
Sat 2010-05-29 08:15:17: <-- 250-AUTH=LOGIN PLAIN
Sat 2010-05-29 08:15:17: <-- 250-coremail 1Uxr2xKj7kG0xkI17xGrU7I0s8FY2U3Uj8Cz28x1UUUUU7Ic2I0Y2UF7w4PGUCa0xDrUUUUj
Sat 2010-05-29 08:15:17: <-- 250 8BITMIME
Sat 2010-05-29 08:15:17: --> MAIL From:<tech@XXXX.com>
Sat 2010-05-29 08:15:17: <-- 250 Mail OK
Sat 2010-05-29 08:15:17: --> RCPT To:<jianhua_91@126.com>
Sat 2010-05-29 08:15:17: <-- 250 Mail OK
Sat 2010-05-29 08:15:17: --> DATA
Sat 2010-05-29 08:15:17: <-- 354 End data with <CR><LF>.<CR><LF>
Sat 2010-05-29 08:15:17: 正在发送 <e:\mdaemon\queues\remote\pd35000893993.msg> 到
Sat 2010-05-29 08:15:17: 发送完成。
Sat 2010-05-29 08:15:17: <-- 250 Mail OK queued as mx4,IsmowKCb3_FEXwBMx6ogAg--.166S2 1275092804
Sat 2010-05-29 08:15:17: --> QUIT
Sat 2010-05-29 08:15:17: <-- 221 Bye
Sat 2010-05-29 08:15:17: SMTP 连接成功完成(字节入/出: 377/3854)
Sat 2010-05-29 08:15:17: ---------- 1. 设定发送邮件必须经过密码验证. (当邮件来自本地帐号, 总是需要验证)
2. 注意禁止中聚的信任主机IP...
3. 最好设定SPF可以解决这个问题 严格的SPF就可阻挡
要-all不要～all
页:
[1]
