Home / server / Questions / 585605
In Process
forestclown
Asked: 2014-04-01 02:20:31 +0800 CST

Does the spam keyword appear in mail log means that the email is marked as spam?

  • 772

When looking at my mail log I have noticed the following:

mail/mail.log.3:297:Mar 30 18:31:21 www postfix/smtp[21129]: 7A6C51014035D: to=<[email protected]>, relay=spam.aserve.com.tw[118.163.3.51]:25, delay=12, delays=0.01/0/10/2.1, dsn=2.0.0, status=sent (250 2.0.0 s2UAS7BE024449 Message accepted for delivery)

The text here [relay=spam.aserve.com.tw] contain the word "spam". Can I assume that the email is marked as spam?

email

2 Answers

  1. No. For better or for worse, this turns out to be their main mail server:

    [me@risby ~]$ dig mx aserve.com.tw
[...]
;; ANSWER SECTION:
aserve.com.tw.      3600    IN  MX  1 spam.aserve.com.tw.
aserve.com.tw.      3600    IN  MX  10 mail.aserve.com.tw.

    I'm not sure why anyone would call their primary mail server by such a name, but it's just a name. They may well have filed your email as spam, but if they have, it won't be because of the name of the server.

    • 4

  2. They may be using spam.aserve.com.tw. as a spam filter. A proper email server will try spam.aserve.com.tw. and if that fails then try mail.aserve.com.tw.. Spambots are likely to try only one address. By using two addresses it is possible to use this connection sequence to filter some email. There may slightly delay email deliveries to them, but should not cause you email to be classified as spam.

    Their broken SPF record indicates they may send email from either server. If you see email arriving from spam.aserve.com.tw., this does not indicate that the message is spam.

    If they use a database to track source addresses, it is possible to identify sending programs that do not follow the standard and connect to the mail servers in the correct order. How they handle senders that do not follow standards is up to them, but I would block all such senders that don't pass rDNS verification. Failed addresses can be agressively removed from the database. It would be appropriate to keep passing addresses in the database, flagged accordingly.

    EDIT: Based on the behavior of their servers they may be failing mail delivered to the backup server mail.aserve.com.tw. and accepting mail delivered to the preferred mail server spam.aserve.com.tw.. This will cause spambots which send to backup mail servers to fail.

    • 1