Re: [exim] Is that SPAM? Or am I compromised?

Top Page
Delete this message
Reply to this message
Author: Slavko
Date:  
To: exim-users
Subject: Re: [exim] Is that SPAM? Or am I compromised?
Hi,

Dňa 13. marca 2023 19:12:20 UTC používateľ Yves via Exim-users <exim-users@???> napísal:

>which returned nothing, and $?==0. So the signature is valid!


I never used OpenDKIM, thus i cannot comment.

>I checked per your advice on the server:
>
>[root@seuil3 etc]# journalctl --grep 640E42D8.7020207
>mars 12 20:23:47 seuil3 spamd[522247]: spamd: checking message <640E42D8.7020207@???> for nobody:182
>mars 12 20:24:02 seuil3 spamd[522247]: spamd: result: . 3 - BAYES_00,BITCOIN_PAY_ME,BITCOIN_SPAM_02,BITCOIN_YOUR_INFO,DKIM_ADSP_ALL,HELO_NO_DOMAIN,HTML_MESSAGE,PDS_BTC_ID,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DNSWL_>


These are from SA, i never used it, thus i cannot comment.

>mars 12 20:24:02 seuil3 exim[594126]: 2023-03-12 20:24:02 1pbRIJ-002UYg-0j <= admin@??? H=([93.184.14.24]) [93.184.14.24] P=esmtp S=6613 id=640E42D8.7020207@???


That one is relevant, but incomplete exim message log. The missing part
is delivery. I do not use journal for exim logs, but you can try to grep exim's
message ID:

    journalctl --no-pager -u exim.service --grep 1pbRIJ-002UYg-0j


>All 3 lines seem to me to relate to receiving the message. I don’t see a line that is about sending the message, or signing it.


Yes, received. The line has no DKIM= field, which is logged by default,
thus seems that message had not valid DKIM at that time.

>Could it be that the message is signed when I receive it?


Exim signs only on delivery...

> Could it be because I use LMTP for delivering, instead of local drop?


Yes, (one of) delivery to LMTP can be configred to sign message,
but someone must configure that.

>If that is the explanation, it seems a bit “stupid” of Exim to do so…


Exim does what admin configured for it, thus try to guess who did
something "a bit stupid"...

regards


--
Slavko
https://www.slavino.sk/