Home / server / Questions / 108748
In Process
philfreo
Asked: 2010-02-03 06:44:21 +0800 CST

Please explain my VPS's Mail Queue Manager

  • 772

On my VPS in WebHost Manager I have an area called Mail Queue Manager. I frequently have a few messages built up in there that seem to contain viruses and other problems.

What are these messages, exactly? Are they messages that are attempted to be delivered TO my domain? Or are they messages that somehow are attempted to by sent FROM my domain?

I'm worried that somehow my server is insecure and spammers are using it. Does this message confirm or deny this?

Note: I forward my [email protected] to [email protected], and I send mail from Gmail but using my MYDOMAIN.com SMTP servers.

1NbSMG-0005mN-Ul-H
mailnull 47 12
<>
1264915708 0
-ident mailnull
-received_protocol local
-body_linecount 230
-max_received_linelength 80
-allow_unqualified_recipient
-allow_unqualified_sender
-frozen 1264915709
-localerror
XX
1
[email protected]

144P Received: from mailnull by vps.MYDOMAIN.com with local (Exim 4.69)
    id 1NbSMG-0005mN-Ul
    for [email protected]; Sun, 31 Jan 2010 00:28:28 -0500
040  X-Failed-Recipients: [email protected]
029  Auto-Submitted: auto-replied
060F From: Mail Delivery System <[email protected]>
022T To: [email protected]
059  Subject: Mail delivery failed: returning message to sender
049I Message-Id: <[email protected]>
038  Date: Sun, 31 Jan 2010 00:28:28 -0500

1NbSMG-0005mN-Ul-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  [email protected]
    (ultimately generated from [email protected])
    SMTP error from remote mail server after end of data:
    host gmail-smtp-in.l.google.com [209.85.221.42]:
    552-5.7.0 Our system detected an illegal attachment on your message. Please
    552-5.7.0 visit http://mail.google.com/support/bin/answer.py?answer=6590 to
    552 5.7.0 review our attachment guidelines. 8si6597260qyk.56

------ This is a copy of the message, including all the headers. ------

Return-path: <[email protected]>
Received: from dyncable-72-159-38-204.bardstown.com ([72.159.38.204])
    by vps.MYDOMAIN.com with esmtp (Exim 4.69)
    (envelope-from <[email protected]>)
    id 1NbSMF-0005kn-3O
    for [email protected]; Sun, 31 Jan 2010 00:28:27 -0500
Received: from 72.159.38.204 by mail.rowzie.com; Sun, 31 Jan 2010 00:27:12 -0500
Message-ID: <000d01caa236$0a893ba0$6400a8c0@gullyj>
From: "Erma Cornelius" <[email protected]>
To: <[email protected]>
Subject: You've received a postcard
Date: Sun, 31 Jan 2010 00:27:12 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
  boundary="----=_NextPart_000_0006_01CAA236.0A893BA0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

This is a multi-part message in MIME format.

------=_NextPart_000_0006_01CAA236.0A893BA0
Content-Type: text/plain;
    format=flowed;
    charset="Windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit

Good day.

Your family member has sent you an ecard

Send free ecards from  with your choice of colors, words and music. 

Your ecard will be available with us for the next 30 days. 

If you wish to keep the ecard longer, you may save it on your computer or take a
print. 

To view your ecard, open zip attached file.

------=_NextPart_000_0006_01CAA236.0A893BA0
Content-Type: application/zip;
    name="ecard.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
    filename="ecard.zip"

(attachment data here)
email spam smtp

2 Answers

  1. You need to configure your vps's firewall to close port 25 to external traffic.

    If you would like to send mail from your webserver you can still do this with port 25 closed to the outside world, preventing 99% of your problems.

    If you need an SMTP server for external traffic, use the one the hosting company provides.

    Otherwise, you will spend a large majority of time keeping your SMTP server patched and closed to malicious traffic.

    • 2

  2. What are these messages, exactly? Are they messages that are attempted to be delivered TO my domain? Or are they messages that somehow are attempted to by sent FROM my domain?

    SPAMmers are relaying emails through your server to outside world. Your email server is configured as an open relay and therefore this is happening.

    I'm worried that somehow my server is insecure and spammers are using it. Does this message confirm or deny this?

    Server is configured incorrectly and therefore is insecure. However, there is an easy way to fix this:

    1. Run your MTA (Email server) only on Loop back interface (127.0.0.1).
    2. Close port 25 from outside (please note that this is not required at all to send emails).
    • 1