Spamassassin Auto-generated Email

Hi, I have searched the forum and net now for too long. Time to break down and ask the forum. This should be really easy (I hope).

I have enabled spamassassin and it is working. HOWEVER, when I get an email tagged **SPAM** the body of the email directs me to ask questions to [email protected]. This should read postmaster.

I have read through the perfect setup docs, looked in the spamassassin folders within /home/ . . ., the users .spamassassin, postfix config files. I am not sure where this address is coming from. Worse case I can just create an alias for 1postmaster but I'm thinking this was just a slip of the finger 'sometime' and I need to correct.

** from email **
Spam detection software, has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see [email protected] for details.
** end email **

Thanks for all the help.

 

Yes bijouenhancements.com is my domain.

As I said above the problem lies in the email sending the user to 1postmaster instead of just postmaster.

 

Isnt it the main postfix administrator's email? it should be on /etc/postfix/main.conf

 

I have already checked my main.cf file. Here is a copy anyways.

main.cf **
smtpd_banner = $myhostname ESMTP $mail_name
biff = no

append_dot_mydomain = no

smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
smtpd_use_tls = no
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache

myhostname = nexis.shewchuk.ca
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
relayhost =
mynetworks = 127.0.0.0/8
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
smtpd_sasl_local_domain =
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,
reject_rbl_client sbl-xbl.spamhaus.org,
reject_rbl_client cbl.abuseat.org,
reject_rbl_client relays.ordb.org,
reject_rbl_client bl.spamcop.net

smtpd_tls_auth_only = no
smtp_use_tls = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

virtual_maps = hash:/etc/postfix/virtusertable

mydestination = localhost, /etc/postfix/local-host-names, 127.0.0.1
**

 

Please check your ISPConfig settings under Management -> Server -> Settings.

 

That was the first area I checked. I don't have any postmaster email addresses present.

The fields that contain email addresses are:
Server,Email, DNS -> Admin Email

This really isn't making much sense. I don't even recall needing to enter [email protected] before.

 

Did you check in the mail's header that the mail really came from your server? Maybe it's just another spam attempt from someone else who tries to make the mail look like it was generated by your server.

Also, do you see anything in your mail log when you receive such a mail?

 

The messages do appear correctly in my log. The Headers are also correct.

Under the email tab in Management where would my "Admin email address" be found saved?

Thanks for the ideas.

 

It's in the isp_server table in the ISPConfig database.

 

Could spamassassin be looking up a value stored within the an isp_xxxxx database?

 

Then are there any other suggestions that I can try. Like I posted earlier I followed the 'Perfect' Setup and haven't done any extra playing. I'm guess when I typed it in 'somewhere' I added the '1'. Now I just need to trace it back.

Thanks for any ideas.

 

You can try this:

Code:

cd /
grep -R 1postmaster *

This will find all files that contain the string 1postmaster.

 

Thanks Falko,
I had tried the locate command but it makes sense to use the grep command. I didn't know it would search ALL txt files.

In case others want to change the email generated by spamassassin the file is:

/home/admispconfig/ispconfig/tools/spamassassin/usr/share/spamassassin/10_misc.cf

This is where I was able to remove the 1 from the postmaster email address.