1 最后由 youliang (2017-09-29 16:43:28) 编辑

主题: 人事一直收到垃圾邮件,每天二三十封,请问如何拦截。

==== 必填信息。没有填写将不予回复 ====
- iRedMail 版本号:0.9.6
- 使用哪个数据库存储用户帐号(OpenLDAP,MySQL,PostgreSQL):mysql
- 使用的 Linux/BSD 发行版名称及版本号:centos7
- 与您的问题相关的日志信息:
====
Sep 29 16:21:53 vm-mail postfix/smtpd[27329]: disconnect from unknown[x.x.x.x]
Sep 29 16:21:55 vm-mail postfix/smtpd[27122]: NOQUEUE: reject: RCPT from unknown[x.x.x.x]: 550 5.1.1 <021-

51350292service@XXXXsh.com>: Recipient address rejected: User unknown in virt
ual mailbox table; from=<snogfgwpy@flvr.com> to=<021-51350292service@XXXXsh.com> proto=ESMTP helo=<flvr.com>
Sep 29 16:21:55 vm-mail postfix/smtpd[27122]: disconnect from unknown[x.x.x.x]
Sep 29 16:22:13 vm-mail postfix/postscreen[23750]: CONNECT from [213.219.101.226]:16610 to [x.x.x.x]:25
Sep 29 16:22:13 vm-mail postfix/postscreen[23750]: PASS OLD [213.219.101.226]:16610
Sep 29 16:22:13 vm-mail postfix/smtpd[27329]: connect from 226.101.219.213.sta.estpak.ee[213.219.101.226]
Sep 29 16:22:14 vm-mail postfix/postscreen[23750]: CONNECT from [x.x.x.x]:51008 to [x.x.x.x]:25
Sep 29 16:22:14 vm-mail postfix/postscreen[23750]: PASS OLD [x.x.x.x]:51008
Sep 29 16:22:14 vm-mail postfix/smtpd[27122]: connect from unknown[x.x.x.x]
Sep 29 16:22:15 vm-mail postfix/smtpd[27122]: Anonymous TLS connection established from unknown[x.x.x.x]:

TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Sep 29 16:22:16 vm-mail postfix/smtpd[27329]: warning: 226.101.219.213.sta.estpak.ee[213.219.101.226]: SASL

LOGIN authentication failed: UGFzc3dvcmQ6
Sep 29 16:22:16 vm-mail postfix/smtpd[27329]: disconnect from 226.101.219.213.sta.estpak.ee[213.219.101.226]
Sep 29 16:22:20 vm-mail postfix/smtpd[27122]: 41ECF41BADC7: client=unknown[x.x.x.x]
Sep 29 16:22:20 vm-mail postfix/cleanup[27987]: 41ECF41BADC7: message-id=<20170929162212244261@ba836.com>
Sep 29 16:22:20 vm-mail postfix/qmgr[2321]: 41ECF41BADC7: from=<post1@ba836.com>, size=39663, nrcpt=1 (queue

active)
Sep 29 16:22:20 vm-mail postfix/smtpd[27122]: disconnect from unknown[x.x.x.x]
Sep 29 16:22:29 vm-mail postfix/10025/smtpd[28004]: connect from vm-mail.poocan.com[127.0.0.1]
Sep 29 16:22:29 vm-mail postfix/10025/smtpd[28004]: 5135141BADC8: client=vm-mail.poocan.com[127.0.0.1]
Sep 29 16:22:29 vm-mail postfix/cleanup[27987]: 5135141BADC8: message-id=<20170929162212244261@ba836.com>
Sep 29 16:22:29 vm-mail postfix/10025/smtpd[28004]: disconnect from vm-mail.poocan.com[127.0.0.1]
Sep 29 16:22:29 vm-mail postfix/qmgr[2321]: 5135141BADC8: from=<post1@ba836.com>, size=40478, nrcpt=1 (queue

active)
Sep 29 16:22:29 vm-mail amavis[25801]: (25801-12) Passed CLEAN {RelayedInbound}, [x.x.x.x]:51008 [x.x.x.x]

<post1@ba836.com> -> <meganliu@XXXXsh.com>, Queue-ID: 41ECF41BADC7, M
essage-ID: <20170929162212244261@ba836.com>, mail_id: lzZA7BhQctcy, Hits: 6.031, size: 39663, queued_as:

5135141BADC8, 8942 ms, Tests: [HTML_FONT_FACE_BAD=0.289,HTML_MESSAGE=0.001,NO_RDNS_DOT
COM_HELO=0.433,RCVD_FAKE_HELO_DOTCOM=2.389,RCVD_IN_BRBL_LASTEXT=1.644,RDNS_NONE=1.274,URIBL_BLOCKED=0.001]
Sep 29 16:22:29 vm-mail postfix/smtp-amavis/smtp[27989]: 41ECF41BADC7: to=<meganliu@XXXXsh.com>,

relay=127.0.0.1[127.0.0.1]:10024, delay=14, delays=5.3/0.02/0.01/9, dsn=2.0.0, status=sent (2
50 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 5135141BADC8)
Sep 29 16:22:29 vm-mail postfix/qmgr[2321]: 41ECF41BADC7: removed
Sep 29 16:22:29 vm-mail postfix/pipe[28005]: 5135141BADC8: to=<meganliu@XXXXsh.com>, relay=dovecot,

delay=0.18, delays=0.07/0.02/0/0.09, dsn=2.0.0, status=sent (delivered via dovecot service
)
Sep 29 16:22:29 vm-mail postfix/qmgr[2321]: 5135141BADC8: removed

回复: 人事一直收到垃圾邮件,每天二三十封,请问如何拦截。

youliang 写道:

5135141BADC8, 8942 ms, Tests: [HTML_FONT_FACE_BAD=0.289,HTML_MESSAGE=0.001,NO_RDNS_DOT
COM_HELO=0.433,RCVD_FAKE_HELO_DOTCOM=2.389,RCVD_IN_BRBL_LASTEXT=1.644,RDNS_NONE=1.274,URIBL_BLOCKED=0.001]

可以尝试调高上面的 NO_RDNS_DOTCOM_HELO、RCVD_FAKE_HELO_DOTCOM、RCVD_IN_BRBL_LASTEXT、RDNS_NONE 的分数,这样会让它被标记为 spam,然后被投递到 Junk 邮箱目录。