Home / server / Questions / 803937
Accepted
ychaouche
Asked: 2016-09-20 02:31:49 +0800 CST

How to find original sender of email?

  • 772

I found some messages that were to be delievered to [email protected] and would like to know who sent them. When searching the logs I find the sender is "<>" so it might be postfix (mailer daemon), but how can I trace back the original sender ?

Sep 18 14:34:02 messagerie postfix/cleanup[610]: 6766E1E922DB: message-id=<[email protected]>
Sep 18 14:34:02 messagerie postfix/qmgr[2749]: 6766E1E922DB: from=<>, size=35673, nrcpt=1 (queue active)
Sep 18 14:34:03 messagerie postfix/pipe[648]: 6766E1E922DB: to=<[email protected]>, relay=maildrop, delay=0.59, delays=0.03/0.19/0/0.37, dsn=4.3.0, status=deferred (temporary failure. Command output: /usr/bin/maildrop: Unable to create a dot-lock at /var/vmail/domain.tld/rpub/1116.0.messagerie.domain.tld.  )
Sep 18 14:41:30 messagerie postfix/qmgr[2749]: 6766E1E922DB: from=<>, size=35673, nrcpt=1 (queue active)
Sep 18 14:41:30 messagerie postfix/pipe[656]: 6766E1E922DB: to=<[email protected]>, relay=maildrop, delay=448, delays=448/0.07/0/0.05, dsn=4.3.0, status=deferred (temporary failure. Command output: /usr/bin/maildrop: Unable to create a dot-lock at /var/vmail/domain.tld/rpub/4281.0.messagerie.domain.tld.  )
Sep 18 14:51:30 messagerie postfix/qmgr[2749]: 6766E1E922DB: from=<>, size=35673, nrcpt=1 (queue active)
Sep 18 14:51:31 messagerie postfix/pipe[5595]: 6766E1E922DB: to=<[email protected]>, relay=maildrop, delay=1049, delays=1049/0.11/0/0.04, dsn=4.3.0, status=deferred (temporary failure. Command output: /usr/bin/maildrop: Unable to create a dot-lock at /var/vmail/domain.tld/rpub/5601.0.messagerie.domain.tld.  )
Sep 18 15:11:30 messagerie postfix/qmgr[2749]: 6766E1E922DB: from=<>, size=35673, nrcpt=1 (queue active)
Sep 18 15:11:30 messagerie postfix/pipe[8843]: 6766E1E922DB: to=<[email protected]>, relay=maildrop, delay=2248, delays=2248/0.11/0/0.05, dsn=4.3.0, status=deferred (temporary failure. Command output: /usr/bin/maildrop: Unable to create a dot-lock at /var/vmail/domain.tld/rpub/9050.0.messagerie.domain.tld.  )

Edit

As pointed out by @RyanBabchishin I have skipped some lines in the logs. By searching carefully again for the qid I found this : 

Sep 18 14:34:02 messagerie postfix/cleanup[610]: 6766E1E922DB: message-id=<[email protected]>
[... Many lines later ...]
Sep 18 14:34:02 messagerie postfix/bounce[777]: 283821E922D9: sender non-delivery notification: 6766E1E922DB
Sep 18 14:34:02 messagerie postfix/qmgr[2749]: 6766E1E922DB: from=<>, size=35673, nrcpt=1 (queue active)

So in reality 6766E1E922DB is a bounce of 283821E922D9. If I search for 283821E922D9 I can get to the original sender (which should be rpub itself) :

Sep 18 14:34:01 messagerie postfix/smtpd[31851]: 283821E922D9: client=localhost[127.0.0.1]
Sep 18 14:34:01 messagerie postfix/cleanup[718]: 283821E922D9: message-id=<[email protected]>
Sep 18 14:34:01 messagerie postfix/smtpd[31851]: disconnect from localhost[127.0.0.1]
Sep 18 14:34:01 messagerie postfix/qmgr[2749]: 283821E922D9: from=<[email protected]>, size=32590, nrcpt=2 (queue active)

Quod Erat Demonstrandum

postfix

2 Answers

  1. A sender of an e-mail can easily be spoofed, so you can't use the senders e-mail for anything useful. The only relevant information you can trust is the SMTP-server from which the e-mail was sent.

    • 1
  2. Best Answer

    By searching the logs again

    Sep 18 14:34:02 messagerie postfix/cleanup[610]: 6766E1E922DB: message-id=<[email protected]>
[... Many lines later ...]
Sep 18 14:34:02 messagerie postfix/bounce[777]: 283821E922D9: sender non-delivery notification: 6766E1E922DB
Sep 18 14:34:02 messagerie postfix/qmgr[2749]: 6766E1E922DB: from=<>, size=35673, nrcpt=1 (queue active)

    Is was a bounce for 283821E922D9. A search for that QID gives the original sender :

    Sep 18 14:34:01 messagerie postfix/qmgr[2749]: 283821E922D9: from=<[email protected]>, size=32590, nrcpt=2 (queue active)
    • 0