Unsolicited bulk e-mail (UBE).

[NetworkExpertise]

Why do my customers get the message below when forwarding and email with a link in it to someone? They are using PORT 587 for SMTP too!

> Our internal reference code for your message is 26618-06/PyXvg8CcMrKh
>
> The message carried your return address, so it was either a genuine
> mail from you, or a sender address was faked and your e-mail address
> abused by third party, in which case we apologize for undesired notification.
>
> We do try to minimize backscatter for more prominent cases of UBE and
> for infected mail, but for less obvious cases of UBE some balance
> between losing genuine mail and sending undesired backscatter is
> sought, and there can be some collateral damage on both sides.
>

[motokochan]

Is this from the remote server or the local?

[NetworkExpertise]

From the local server. When a client of mine whom hosts their domain with me emails someone, and within her email is a url/link my Omega box returns this message to her.

[NetworkExpertise]

I really need to know what the hell is kicking this message back to my customer?? Is it Amavis? This email doesnt even leave my mailserver I think something is kicking this back to the client!!!


>A message from <my@customer.com> to:
> -> someoutside@emailaddress.com
>
> was considered unsolicited bulk e-mail (UBE).
>
> Our internal reference code for your message is 03870-06/5ciqDZxspqnO
>
> The message carried your return address, so it was either a genuine
> mail from you, or a sender address was faked and your e-mail address
> abused by third party, in which case we apologize for undesired notification.
>
> We do try to minimize backscatter for more prominent cases of UBE and
> for infected mail, but for less obvious cases of UBE some balance
> between losing genuine mail and sending undesired backscatter is
> sought, and there can be some collateral damage on both sides.
>
> First upstream SMTP client IP address: [24.23.XX.XX]
> c-24-23-XX-XX.hsd1.ca.comcast.net According to a 'Received:' trace,
> the message originated at:
> [24.23.XX.XX],
> KELLY (c-24-23-XX-XX.hsd1.ca.comcast.net [24.23.XX.XX])
>
> Return-Path: <my@customer.com>
> Message-ID: <5946AF9F867B44ECA84DE3718879D2A0@customer.com>
> Subject: Fax Cover Sheet
>
> Delivery of the email was stopped!

[motokochan]

That message is generated by AMaViSd-new. I don't believe that any user that authenticates goes through it, but I could be mistaken.

[NetworkExpertise]

Beats the heck out of my why.... It just happens to this one person!

[motokochan]

Can you confirm they are actually using smtp auth?

[NetworkExpertise]

Will do tomorrow thanks!