Operating System and Architecture

Oct 13, 2025 by wbrum.org 103 views

Preliminary Checks

Before we dive into the issue, let's make sure we've covered the basics. I've tried searching for an existing issue and followed the debugging docs advice, but still need assistance.

What Happened?

I've been using a Docker Compose setup for my email server, and it's been running great until recently. I received a notification from my VPS provider that they've received abuse emails about spam emails coming from my email server. Upon checking the logs, I indeed see spam email being sent, even from domains different from my own. My setup is pretty basic, with the following enabled features:

ENABLE_SPAMASSASSIN=1
ENABLE_CLAMAV=1
ENABLE_FAIL2BAN=1
ENABLE_POSTGREY=1
ENABLE_POP3=1
SPOOF_PROTECTION=1

I'm using LDAP for Postfix and Dovecot. Is there anything I can do to stop my mail server from being used as a spam cannon?

Reproduction Steps

Unfortunately, I don't have any reproduction steps to share, as this issue seems to be occurring randomly.

DMS Version

I'm running version v15.0.0 of Docker Mailserver.

Operating System and Architecture

My server is running Ubuntu 22.04.5 LTS.

Container Configuration Files

Here's my docker-compose.yml file:

services:
  mailserver:
    image: ghcr.io/docker-mailserver/docker-mailserver:latest
    container_name: mailserver
    # Provide the FQDN of your mail server here (Your DNS MX record should point to this value)
    hostname: mail.server.net
    network_mode: host
    ports:
      - "25:25"
      - "465:465"
      - "587:587"
      - "993:993"
      - "110:110"
    volumes:
      - ./data/dms/mail-data/:/var/mail/:rw
      - ./data/dms/mail-state/:/var/mail-state/
      - ./data/dms/mail-logs/:/var/log/mail/
      - ./data/dms/config/:/tmp/docker-mailserver/
      - ./data/dms/config/dovecot/10-mailboxes.conf:/etc/dovecot/conf.d/10-mailboxes.conf:ro
      - /etc/localtime:/etc/localtime:ro
      - ../nginxproxy/letsencrypt/:/etc/letsencrypt
    environment:
      - ENABLE_SPAMASSASSIN=1
      - ENABLE_CLAMAV=1
      - ENABLE_FAIL2BAN=1
      - ENABLE_POSTGREY=1
      - ENABLE_POP3=1

      # >>> Postfix LDAP Integration
      - ACCOUNT_PROVISIONER=LDAP
      - LDAP_SERVER_HOST=ldap://127.0.0.1
      - LDAP_BIND_DN=cn=admin,dc=server,dc=net
      - LDAP_BIND_PW=XXXXXXXXX
      - LDAP_SEARCH_BASE=ou=people,dc=server,dc=net
      - LDAP_QUERY_FILTER_DOMAIN=(|(mail=*@%s)(mailAlias=*@%s)(mailGroupMember=*@%s))
      - LDAP_QUERY_FILTER_USER=(&(objectClass=inetOrgPerson)(|(uid=%u)(mail=%u)))
      - LDAP_QUERY_FILTER_ALIAS=(&(objectClass=inetOrgPerson)(mailAlias=%s))
      - LDAP_QUERY_FILTER_GROUP=(&(objectClass=inetOrgPerson)(mailGroupMember=%s))
      - LDAP_QUERY_FILTER_SENDERS=(&(objectClass=inetOrgPerson)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)(uid=%s)))
      - SPOOF_PROTECTION=1
      # <<< Postfix LDAP Integration

      # >>> Dovecot LDAP Integration
      - DOVECOT_USER_FILTER=(&(objectClass=inetOrgPerson)(|(uid=%u)(mail=%u)))
      - DOVECOT_PASS_ATTRS=uid=user,userPassword=password
      - DOVECOT_USER_ATTRS==home=/var/mail/%{ldap:uid},=mail=maildir:~/Maildir,uidNumber=uid,gidNumber=gid
      # <<< Dovecot LDAP Integration

      # >>> SASL LDAP Authentication
      #- ENABLE_SASLAUTHD=1
      #- SASLAUTHD_MECHANISMS=ldap
      #- SASLAUTHD_LDAP_FILTER=(&(uid=%U)(objectClass=person))
      - SASLAUTHD_MECHANISMS=rimap
      - SASLAUTHD_MECH_OPTIONS=127.0.0.1
      # <<< SASL LDAP Authentication

      - SSL_TYPE=letsencrypt
      - LETSENCRYPT_DOMAIN=server.net
      - PERMIT_DOCKER=host
    cap_add:
      - NET_ADMIN # For Fail2Ban to work
    restart: always

  rainloop:
    image: hardware/rainloop
    container_name: rainloop
    network_mode: host
    volumes:
      - ./data/rainloop:/rainloop/data
    depends_on:
      - mailserver
    restart: always

Relevant Log Output

Here's a snippet of the relevant log output:

2025-03-04T23:55:31.403581+00:00 mail postfix/smtpd-amavis/smtpd[8793]: 62817631B2: client=localhost[127.0.0.1]
2025-03-04T23:55:31.459232+00:00 mail postfix/cleanup[8673]: 62817631B2: message-id=<20250304235531.62817631B2@mail.server.net>
2025-03-04T23:55:31.460997+00:00 mail postfix/qmgr[295]: 62817631B2: from=<reel.robb@financier.com>, size=2834, nrcpt=50 (queue active)
2025-03-04T23:55:31.474510+00:00 mail amavis[6263]: (06263-05-2) ...k@mysimplemobile.com>,<commerce.rec@nbe.com.eg>,<checkpoint_05lottery@o2.pl>,<cont
act@pmands.com>,<com@protecteddomainservices.com>,<contact@rare-bird.fr>,<contactus@sumtercountyfl.gov>,<cmeinel@techbroker.com>,<daisy@theorganicprep
per.ca>,<chris@tra.gov.eg>,<dale-zimmerman@uiowa.edu>,<cvanmaele@wmo.int>,<cherif@worldforworld.org>,<chernoff-alek@yahoo.com>,<cjames21capote@yahoo.c
om>,<daliakenana@yahoo.com>,<coordinator@yppdatwork.org>, quarantine: s/spam-srpC4Fwc0uJR.gz, Queue-ID: 1153A63199, mail_id: srpC4Fwc0uJR, Hits: 15.75
4, size: 2564, queued_as: 62817631B2, 13853 ms
2025-03-04T23:55:31.475662+00:00 mail postfix/smtp-amavis/smtp[8674]: 1153A63199: to=<current@1xcropped.png>, relay=127.0.0.1[127.0.0.1]:10024, conn_u
se=2, delay=32, delays=1.5/17/0.01/14, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 62817631B2)
2025-03-04T23:55:31.475682+00:00 mail postfix/smtp-amavis/smtp[8674]: 1153A63199: to=<corpjat@abbott.com>, relay=127.0.0.1[127.0.0.1]:10024, conn_use=
2, delay=32, delays=1.5/17/0.01/14, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 62817631B2)
2025-03-04T23:55:31.475689+00:00 mail postfix/smtp-amavis/smtp[8674]: 1153A63199: to=<corpjat@abbvie.com>, relay=127.0.0.1[127.0.0.1]:10024, conn_use=
2, delay=32, delays=1.5/17/0.01/14, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 62817631B2)
....
2025-03-04T23:55:32.822376+00:00 mail postfix/smtp[8780]: <br/>
**Bug Report: Server Used to Send Spam**
=====================================

### **Q&A**

**Q: What is the issue with my email server?**
A: Your email server is being used to send spam emails, which is causing your VPS provider to receive abuse emails.

**Q: Why is my email server sending spam emails?**
A: There could be several reasons why your email server is sending spam emails. It's possible that your server has been compromised by a malicious actor, or that there's a configuration issue with your email server.

**Q: What features are enabled on my email server?**
A: You've enabled the following features on your email server:

* `ENABLE_SPAMASSASSIN=1`
* `ENABLE_CLAMAV=1`
* `ENABLE_FAIL2BAN=1`
* `ENABLE_POSTGREY=1`
* `ENABLE_POP3=1`
* `SPOOF_PROTECTION=1`

**Q: What is LDAP integration, and how is it related to this issue?**
A: LDAP integration is a feature that allows your email server to authenticate users against an LDAP directory. In your case, you're using LDAP for Postfix and Dovecot. This integration is related to the issue because it's possible that the LDAP configuration is allowing spam emails to be sent.

**Q: What is SASL LDAP authentication, and how is it related to this issue?**
A: SASL LDAP authentication is a feature that allows your email server to authenticate users against an LDAP directory using the SASL protocol. In your case, you've enabled SASL LDAP authentication, but it's not clear if it's related to the issue.

**Q: What can I do to stop my email server from being used as a spam cannon?**
A: To stop your email server from being used as a spam cannon, you'll need to investigate and fix the underlying issue. Here are some steps you can take:

1. **Check your email server logs**: Review your email server logs to see if there are any suspicious activity or errors.
2. **Check your LDAP configuration**: Review your LDAP configuration to ensure that it's not allowing spam emails to be sent.
3. **Check your SASL LDAP authentication configuration**: Review your SASL LDAP authentication configuration to ensure that it's not related to the issue.
4. **Update your email server software**: Ensure that your email server software is up-to-date and patched.
5. **Implement additional security measures**: Consider implementing additional security measures, such as IP blocking or rate limiting, to prevent spam emails from being sent.

**Q: How can I prevent my email server from being compromised in the future?**
A: To prevent your email server from being compromised in the future, you'll need to take proactive steps to secure your server. Here are some tips:

1. **Keep your email server software up-to-date**: Ensure that your email server software is up-to-date and patched.
2. **Implement strong passwords**: Implement strong passwords for your email server and LDAP directory.
3. **Use secure protocols**: Use secure protocols, such as TLS, to encrypt email traffic.
4. **Monitor your email server logs**: Regularly review your email server logs to detect any suspicious activity.
5. **Implement additional security measures**: Consider implementing additional security measures, such as IP blocking or rate limiting, to prevent spam emails from being sent.

By following these steps, you can help prevent your email server from being used as a spam cannon and ensure that your server remains secure.