I had a similar problem. Some infected spam was coming to our machine, to an account which does not exist (ie john@mycompany.com.) To make matters worse, the address was spoofed as if it was coming from that same account (ie john@mycompany.com.)
When the antivirus found the mail, it sent a warning to the sender, to the recipient and to the admin!! Two of the three warnings were redirected to admin as unknown accounts are, and the third was already destined for the admin account. I was receiving 3 identical emails every 2 minutes!!
(I happened to be at home at the time, so luckily our VPN and PuTTY allowed me access to make changes. This was a godsend since if I'd left it till morning, I'd have had thousands of bounced bounces in my inbox.)
This is what I did:
1. Under the RAV configuration page, for warning messags, I set all three options (warn_admin, warn_receivers, warn_sender) to "never." This prevented the message from bouncing around internally as it was the warnings that were double-bouncing.
2. Under the RAV RBL/WBL lists page, I created a WBL entry for john@mycompany.com as a wbl_discard. This will prevent any further emails sent from the spoofed john@mycompany.com from getting into our system, thus preventing significant bouncing.
3. I rebooted the server.
Messages stopped immediately. It was interesting to note that the messages continued despite restarting qmail - only the reboot was adequate to stop the bouncing.
Hope maybe this helps anybody else!
20 Replies
9439 Views