Strange domains and IPs in my log file

[Softbox44]

I am getting some strange log entries with strange Domain/IPs when sending emails.
For example: I am sending from [email protected] to [email protected]
but the IP and domain names mentioned by Postfix and Amavis in the logs are not from my mailserver.

mail.STRANGE_DOMAIN[IP_OF_STRANGE_DOMAIN

Any ideas how this confusion came about?

2024-10-28T17:49:30.950494+00:00 mail postfix/sender-cleanup/cleanup[7691]: E287E7AA98: replace: header MIME-Version: 1.0 from mail.STRANGE_DOMAIN[IP_OF_STRANGE_DOMAIN]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<DESKTOPNEII4G1>: MIME-Version: 1.0
2024-10-28T17:49:33.327160+00:00 mail amavis[1780]: (01780-07) Passed CLEAN {RelayedOpenRelay}, [IP_OF_STRANGE_DOMAIN]:53027 [IP_OF_STRANGE_DOMAIN] <[email protected]> -> <[email protected]>, Queue-ID: E287E7AA98, Message-ID: <[email protected]>, mail_id: JEqaisWJSzZC, Hits: 0.199, size: 5294, queued_as: 487AB7AAA2, 2265 ms
2024-10-28T17:49:33.329783+00:00 mail postfix/smtp-amavis/smtp[7692]: E287E7AA98: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.4, delays=0.14/0.02/0/2.3, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 487AB7AAA2)
2024-10-28T17:49:34.004944+00:00 mail postfix/smtp[7705]: 487AB7AAA2: to=<[email protected]>, relay=mx-ha02.web.de[212.227.17.8]:25, delay=0.72, delays=0.03/0.03/0.34/0.32, dsn=2.0.0, status=sent (250 Requested mail action okay, completed: id=1MALFR-1tBHPy2ut9-000IqT)
2024-10-28T17:58:50.856627+00:00 mail policyd-spf[8669]: : prepend Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=212.227.17.11; helo=mout.web.de; [email protected]; receiver=mydomain.com
2024-10-28T17:58:51.111979+00:00 mail postfix/qmgr[1323]: D49497AAD6: from=<[email protected]>, size=7222, nrcpt=1 (queue active)
2024-10-28T17:58:53.460592+00:00 mail postfix/qmgr[1323]: 6F3A57AAE8: from=<[email protected]>, size=7700, nrcpt=1 (queue active)
2024-10-28T17:58:53.467999+00:00 mail amavis[1780]: (01780-09) Passed CLEAN {RelayedInbound}, [212.227.17.11]:35485 [93.215.30.209] <[email protected]> -> <[email protected]>, Queue-ID: D49497AAD6, Message-ID: <trinity-e66b8de8-b74e-4af8-adcb-6d20f3056ca4-1730138324096@trinity-msg-rest-webde-webde-live-5558b689d9-r2js2>, mail_id: P_OPfph8YCeD, Hits: -0.092, size: 7499, queued_as: 6F3A57AAE8, 2333 ms
2024-10-28T17:59:36.955619+00:00 mail postfix/sender-cleanup/cleanup[8664]: D735E7AAF6: replace: header MIME-Version: 1.0 from mail.STRANGE_DOMAIN[IP_OF_STRANGE_DOMAIN]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<DESKTOPNEII4G1>: MIME-Version: 1.0
2024-10-28T17:59:40.042369+00:00 mail amavis[1781]: (01781-09) Passed CLEAN {RelayedOpenRelay}, [IP_OF_STRANGE_DOMAIN]:58979 [IP_OF_STRANGE_DOMAIN] <[email protected]> -> <[email protected]>, Queue-ID: D735E7AAF6, Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAADWO2dXpVaZKhNL/xW9lbUsBAMO2jhD3dRHOtM0AqgC7tuYAAAAAAA4AABAAAAAjyfSztdsmQrV9+ZXcRpsNAQAAAAA=@mydomain.com>, mail_id: BO7di28NEzuB, Hits: 0.199, size: 3099947, queued_as: E3A227AB0C, 2422 ms
2024-10-28T17:59:40.044652+00:00 mail postfix/smtp-amavis/smtp[8665]: D735E7AAF6: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=3.2, delays=0.74/0/0/2.4, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as E3A227AB0C)
2024-10-28T17:59:41.378126+00:00 mail postfix/smtp[8685]: E3A227AB0C: to=<[email protected]>, relay=mx-ha03.web.de[212.227.15.17]:25, delay=1.4, delays=0.1/0/0.32/1, dsn=2.0.0, status=sent (250 Requested mail action okay, completed: id=1MafGA-1tbnyI1Wfa-00oO4I)
2024-10-28T18:14:31.527763+00:00 mail postfix/sender-cleanup/cleanup[12502]: 7A8DF7AB81: replace: header MIME-Version: 1.0 from mail.STRANGE_DOMAIN[IP_OF_STRANGE_DOMAIN]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<DESKTOPNEII4G1>: MIME-Version: 1.0
2024-10-28T18:14:33.971164+00:00 mail amavis[11632]: (11632-02) Passed CLEAN {RelayedOpenRelay}, [IP_OF_STRANGE_DOMAIN]:59105 [IP_OF_STRANGE_DOMAIN] <[email protected]> -> <[email protected]>, Queue-ID: 7A8DF7AB81, Message-ID: <[email protected]>, mail_id: ooD5SkH4W_yY, Hits: 0.199, size: 8551, queued_as: E6E227AB8E, 2353 ms
2024-10-28T18:14:33.972763+00:00 mail postfix/smtp-amavis/smtp[12421]: 7A8DF7AB81: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.5, delays=0.14/0/0/2.4, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as E6E227AB8E)
2024-10-28T18:14:34.506171+00:00 mail postfix/smtp[12419]: E6E227AB8E: to=<[email protected]>, relay=mx-ha03.web.de[212.227.15.17]:25, delay=0.56, delays=0.02/0/0.31/0.23, dsn=2.0.0, status=sent (250 Requested mail action okay, completed: id=1MF1cS-1t7iGA1C4O-0058FT)
2024-10-28T18:17:02.086893+00:00 mail policyd-spf[12764]: : prepend Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=212.227.17.11; helo=mout.web.de; [email protected]; receiver=mydomain.com
2024-10-28T18:17:02.311691+00:00 mail postfix/qmgr[11605]: 17EF97AB91: from=<[email protected]>, size=13287, nrcpt=1 (queue active)
2024-10-28T18:17:04.652347+00:00 mail postfix/qmgr[11605]: 9DEE47AB97: from=<[email protected]>, size=13765, nrcpt=1 (queue active)
2024-10-28T18:17:04.659248+00:00 mail amavis[11633]: (11633-02) Passed CLEAN {RelayedInbound}, [212.227.17.11]:43069 [93.215.30.209] <[email protected]> -> <[email protected]>, Queue-ID: 17EF97AB91, Message-ID: <trinity-f1550cc5-3019-4763-a147-09ac5dd1dc66-1730139421247@trinity-msg-rest-webde-webde-live-5558b689d9-9pcwk>, mail_id: sZi0tLmUOUMI, Hits: -0.096, size: 13562, queued_as: 9DEE47AB97, 2326 ms

[casperklein]

The "strange" IP / Hostname is from the client sending the mail. So probably it's your public IP address from your ISP. And the hostname is the corresponding reverse DNS of that IP.

[Softbox44]

Yes. This could be right. The strange thing though is, that my daily Postfix report shows the following error: submissions/smtpd (total: 26) 7 hostname mail.STRANGE_DOMAIN does not resolve to address IP_OF_STRANGE_DOMAIN Any idea what this could be caused by?

…

On Fri, 1 Nov 2024 at 21:15, Casper ***@***.***> wrote: The "strange" IP / Hostname is from the client sending the mail. So probably it's your public IP address from your ISP. And the hostname is the corresponding reverse DNS of that IP. — Reply to this email directly, view it on GitHub <#4242 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BG62B2TE4EY7GKE7K2573JDZ6PVOHAVCNFSM6AAAAABQYDKVG2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCMJSGYYDMMY> . You are receiving this because you authored the thread.Message ID: <docker-mailserver/docker-mailserver/repo-discussions/4242/comments/11126063 @github.com>

[polarathene]

Any idea what this could be caused by?

Likely your mail client EHLO/HELO, you appear to be sending from a Windows machine?: helo=<DESKTOPNEII4G1>

The mail client connects to DMS (Postfix) and says "Hi I am " and Postfix can check if the IP connecting matches that DNS name for the HELO/EHLO provided.

I am not sure what STRANGE_DOMAIN is meant to look like since you've chosen to obfuscate it. If it's related to the windows hostname I've referred to, that'd make a bit more sense? Does mail.STRANGE_DOMAIN actually resolve to an IP for you if you query the DNS?

[Softbox44]

Yes. I get the Helo mechanism. What I dont understand is that in DMS logs the IP (89.36.66.199) of the sender domain is resolved to mail.xmail44.win. And that works as you said because reverse DNS is setup to show that. Conincendentally this is the domain of my second DMS server, from which I also happen to send some emails. So this now all makes sense, BUT
I still get the errors in my daily Postfix report:

         7   hostname mail.xmail44.win **does not resolve** to address 89.36.66.199

although it clearly does resolve to that IP.

[polarathene]

although it clearly does resolve to that IP

Does it resolve to that within the DMS container?

I'm not sure if we can assist with that without a way to reproduce it. Is there anything in your DMS config that might refer to that domain? Perhaps an alias or mail account? (setup alias add ... / setup email add ...)