Topic: Qmail "anonymous" mail

[Des Dougan]

I have a client who today received an email from anonymous@his_domain_name. Unfortunately, he deleted it before I was called. However, I  have checked the qmail logs and noticed that administrative email is being sent with anonymous as the user name (e.g. backup logs). However, it is being received by the email client from the root account. As well, this user is not the user to whom the admin messages are being sent.

Can anyone who knows qmail shed any light on why this user could have received a message from "anonymous" within his own domain?

My initial thought was of someone trying to spoof the address, but I can find no evidence of that.

Thanks,

Des Dougan

[Darrell May]

Des Dougan wrote:
>
> I have a client who today received an email from
> anonymous@his_domain_name.

This is typically from an internal process running.  This process sent a message using the internal mail command and Qmail accepted it as it was internal but could not determine the username so it adds anonymous as the sender.  The message can then go to anyone the process is supposed to send the message to.

Try this to view all the messages being sent by anonymous:

grep anonymous /var/log/maillog

Regards,

Darrell

[Des Dougan]

Darrell,

At 19:20 18/10/2001, Darrell May wrote:
>Try this to view all the messages being sent by anonymous:

Thanks for your help on this. I found that /var/log/maillog doesn't list
the anonymous messages, but by checking the maillog against the qmail logs,
I was able to determine that it was a message from outside the domain which
had no sender field, so perhaps a spam message with the sender data suppressed.

Cheers,

Des