Detect email spams on your server?

[Marc van Leeuwen]

Is there a way to detect email spams on your server like where did it send from? or which website did it send from?...ect. Normally I used to get this notice from my hosting provider but I wanted to get them directly from my web hosting server. Is that possible?

 

[shiju]

The spamming is 2 types one is outgoing mail spamming, another is incoming mail spamming. Outgoing maybe with the PHP scripts or any other kinds, which causes the compromised root directory of your domain. The second one will be compromising the mail id and password.

So both these spams are finding with the mail logs. We are using Exim mail logs for identifying the spammers. So if you have VPS or control over direct root access you can have those details. Otherwise, you should contact the hosting provider.

Normal users can not identify the emails are sending via the PHP mail function.

Please check for the Exim mail spam-check tutorials if required.

 

[Marc van Leeuwen]

Marc van Leeuwen

So both these spams are finding with the mail logs. We are using Exim mail logs for identifying the spammers. So if you have VPS or control over direct root access you can have those details. Otherwise, you should contact the hosting provider.

Sure but I am wording why they can know my server is being spammed or not. Or email me that my server is sending spams or not. I am wanting to know which tools they used on their server to know that.

 

[shiju]

Best answer

shiju

There is something deep to be discussed. If you are not managing any SPF and DKIM or even an rDNS, will flag and also return failed attempts will higher . The number of mails failed and the number of mails sending from the server is always matters. The website manner depends on what type of mails you are managing, I mean If you are a forum owner so there will be a lot mails to send and receive as verification or other types of communications.
If the number of emails per hour exceeded to their spam filters ( for incoming mail domains), can be flagged and also cross-check with other RBLs for verifications. You can use MXtoolbox for finding the domain/Ip had blacklisted or not.

It is not mandatory that the number of emails exceeded per hour is always spam. But the system is suspecting it may be spam. For Gmails, it may fail and their mail filters are strict as same as Microsoft mails servers. As we can see the RBL listing and server targetting spam also marked as spam, which will automatically block by spam assassin.

If you are managing web server or email server you should scan for malware activity if possible, so that you could found unwanted files or php codes which are using mail function. It is suggestible to disable mail function if you are not using auto mailing feature.

 

[Dreamwebhosts]

Via a compromised mail account: the spammer uses one of your user’s mail accounts to broadcast spam via your own MTA.