今まで、弾かれたメール送信のログばかり書いてきたので、正常な流れを一度書いておく。
spamhausからadminに存在証明としてメールが送られてきた時のログとメールのヘッダを紹介。
流れを見るだけでも気持ち良いよねぇ。
そして、詳しい付加情報は書かない。（面倒だし）
postfixのログ。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
Jun 29 15:14:17 mail postfix/postscreen[73628]: CONNECT from [198.2.136.23]:51119 to [192.168.0.35]:25 Jun 29 15:14:17 mail postfix/dnsblog[73629]: addr 198.2.136.23 listed by domain list.dnswl.org as 127.0.15.0 Jun 29 15:14:17 mail postfix/postscreen[73628]: PASS NEW [198.2.136.23]:51119 Jun 29 15:14:18 mail postfix/smtpd/smtpd[73635]: connect from mail136-23.atl41.mandrillapp.com[198.2.136.23] Jun 29 15:14:19 mail postfix/cleanup[73638]: 60406343A914: message-id=<20260629061419.60406343A914@mail.k-in.co.jp> Jun 29 15:14:19 mail postfix/qmgr[73589]: 60406343A914: from=<double-bounce@k-in.co.jp>, size=267, nrcpt=1 (queue active) Jun 29 15:14:19 mail postfix/smtp[73639]: discarding EHLO keywords: PIPELINING Jun 29 15:14:20 mail postfix/smtp[73639]: discarding EHLO keywords: PIPELINING Jun 29 15:14:20 mail postfix/smtp[73639]: 60406343A914: to=<bounce-md_31032185.6a420d38.v1-53a063d7f0f8443a9a49880cb71d2da8@mandrillapp.com>, relay=9656353.in1.mandrillapp.com[44.239.226.101]:25, delay=1.1, delays=0/0.01/0.88/0.24, tls=may, dsn=2.1.5, status=deliverable (250 2.1.5 Ok) Jun 29 15:14:20 mail postfix/qmgr[73589]: 60406343A914: removed Jun 29 15:14:22 mail postfix/smtpd/smtpd[73635]: C69E5343A917: client=mail136-23.atl41.mandrillapp.com[198.2.136.23] Jun 29 15:14:22 mail postfix/cleanup[73638]: C69E5343A917: message-id=<31032185.20260629061416.6a420d38bbb522.93076822@mail13623.atl41.mandrillapp.com> Jun 29 15:14:23 mail postfix/qmgr[73589]: C69E5343A917: from=<bounce-md_31032185.6a420d38.v1-53a063d7f0f8443a9a49880cb71d2da8@mandrillapp.com>, size=15269, nrcpt=1 (queue active) Jun 29 15:14:23 mail postfix/smtpd/smtpd[73635]: disconnect from mail136-23.atl41.mandrillapp.com[198.2.136.23] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Jun 29 15:14:23 mail postfix/smtp[73644]: discarding EHLO keywords: PIPELINING Jun 29 15:14:46 mail postfix/smtpd:10025/smtpd[73649]: connect from localhost[127.0.0.1] Jun 29 15:14:46 mail postfix/smtpd:10025/smtpd[73649]: C9F1A343A930: client=localhost[127.0.0.1] Jun 29 15:14:46 mail postfix/cleanup[73638]: C9F1A343A930: message-id=<31032185.20260629061416.6a420d38bbb522.93076822@mail13623.atl41.mandrillapp.com> Jun 29 15:14:46 mail postfix/smtpd:10025/smtpd[73649]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Jun 29 15:14:46 mail postfix/qmgr[73589]: C9F1A343A930: from=<bounce-md_31032185.6a420d38.v1-53a063d7f0f8443a9a49880cb71d2da8@mandrillapp.com>, size=16412, nrcpt=1 (queue active) Jun 29 15:14:46 mail postfix/smtp[73644]: C69E5343A917: to=<admin@k-in.co.jp>, relay=127.0.0.1[127.0.0.1]:10024, delay=28, delays=4.6/0.01/0/23, tls=none, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as C9F1A343A930) Jun 29 15:14:46 mail postfix/qmgr[73589]: C69E5343A917: removed Jun 29 15:14:46 mail postfix/local[73650]: C9F1A343A930: passing <admin@k-in.co.jp> to transport=lmtp Jun 29 15:14:46 mail postfix/lmtp[73651]: C9F1A343A930: to=<admin@k-in.co.jp>, relay=mail.k-in.co.jp[private/dovecot-lmtp], delay=0.17, delays=0/0.01/0.02/0.14, tls=none, dsn=2.0.0, status=sent (250 2.0.0 <admin@k-in.co.jp> 4IZgM1YNQmq0HwEAH1x14w Saved) Jun 29 15:14:46 mail postfix/qmgr[73589]: C9F1A343A930: removed |
mail136-23.atl41.mandrillapp.comから始めての接続なので、PASS NEWである。
以前、postfixの新しいタイプのログを発見にも書いたけれど、gmgrが送信者、受信者の存在チェックをして、両者共に存在することを確認している。
198.2.136.23は問題のあるサーバーでないので、postscreeen（zen.spamhaus.org）は何も言わない。
同様にmail136-23.atl41.mandrillapp.comはspam domainではないので、smtpd（dbl.spamhaus.org）も何も言わない。
問題ないメールであるとして、dovecotに受け渡されている。
こっちはメールのヘッダ部。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 |
Return-Path: <bounce-md_31032185.6a420d38.v1-53a063d7f0f8443a9a49880cb71d2da8@mandrillapp.com> Delivered-To: admin@k-in.co.jp Received: from mail.k-in.co.jp by macmini.lo.k-in.co.jp with LMTP id 4IZgM1YNQmq0HwEAH1x14w (envelope-from <bounce-md_31032185.6a420d38.v1-53a063d7f0f8443a9a49880cb71d2da8@mandrillapp.com>) for <admin@k-in.co.jp>; Mon, 29 Jun 2026 15:14:46 +0900 Received: from localhost (localhost [127.0.0.1]) by mail.k-in.co.jp (Postfix) with ESMTP id C9F1A343A930 for <admin@k-in.co.jp>; Mon, 29 Jun 2026 15:14:46 +0900 (JST) X-Virus-Scanned: amavisd-new at k-in.co.jp X-Spam-Flag: NO X-Spam-Score: 1.133 X-Spam-Level: * X-Spam-Status: No, score=1.133 tagged_above=-2 required=6.2 tests=[DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_FONT_SIZE_HUGE=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_GREY=1.084] autolearn=no autolearn_force=no Received: from mail.k-in.co.jp ([127.0.0.1]) by localhost (mail.k-in.co.jp [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XOV6LWF680pO for <admin@k-in.co.jp>; Mon, 29 Jun 2026 15:14:23 +0900 (JST) Received: from mail136-23.atl41.mandrillapp.com (mail136-23.atl41.mandrillapp.com [198.2.136.23]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail.k-in.co.jp (Postfix) with ESMTPS id C69E5343A917 for <admin@k-in.co.jp>; Mon, 29 Jun 2026 15:14:19 +0900 (JST) Authentication-Results: mail.k-in.co.jp; dkim=pass (2048-bit key; unprotected) header.d=mandrillapp.com header.i=@mandrillapp.com header.b=Jeo+DFTK; dkim=pass (2048-bit key; unprotected) header.d=community.spamhaus.org header.i=notification@community.spamhaus.org header.b=nyqW+gLE DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandrillapp.com; s=mte1; t=1782713656; x=1782983656; bh=4LK7bnM7xZBhTXl9wtIsp3Nyw7h0/e0etbsaprvWnbY=; h=From:Subject:To:Feedback-ID:Message-Id:Date:MIME-Version: Content-Type:CC:Date:Subject:From; b=Jeo+DFTKuP/fp6ALhWGNJcxKAEJY8KDgFCRhSephDNjsSYD/rd/zW8MV24p1bj5x1 +tAI1M5m39b4+ifJZamXqi34qV5e+h46ygZnlH/FvqQ+WskNeA9bnSVRHaN4FEWmno dxAi8VIHGBXbGXWEFm44fNMu9hToXzr0Rn8/5OoJHeqrGKNfBwH/EkN6SBriGweSvh 1kvyaT+Qbm2PhkwqCjwDVZMtKWu1vKye+mGSK9jtkqEbuDX0Q1Tx4BA/8kyO58kbkf YSFXlECgZES2I9YhdzsrS8dayK/JUjBONqzxhpUrB6Ri6ao0g6WJiYFfD6qVH9h4H6 sY/w7XJFOHWww== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=community.spamhaus.org; s=mte1; t=1782713656; x=1782974156; i=notification@community.spamhaus.org; bh=4LK7bnM7xZBhTXl9wtIsp3Nyw7h0/e0etbsaprvWnbY=; h=From:Subject:To:Feedback-ID:Message-Id:Date:MIME-Version: Content-Type:CC:Date:Subject:From; b=nyqW+gLEOn149nAqktbgj+cG6ERjq9FTAtmE4j/LkSbUobRB6ouwL4z6uHtndTDbk G6vLldN5XyOqueC/SdtK9QMd5IsktaT4g0DG00bilCUtJoBrX67ceqPIWVQfzL1aiQ LqoSih1EodZ/oN0LGDQj9fauZd1fItBsXgk2Tc2zBmGEIOa1KT23QyUIgGYv3Nhq2I t/0a0mKoLBT1e+58Hy+AnxRKEadlNLtmrZQv+EIsFznW9UzN6mUvNW5CEgHBeXaISc 4UcixzP95f3f+KrZszs/ScexC4pUgM8XD6QDmB0j46LL2RZAlY+gp4RUpy7/pG608Y pkPTCPTt7XZBg== Received: from mta001-md-usw2.delv.a.intuit.com (localhost [127.0.0.1]) by mail136-23.atl41.mandrillapp.com (Mailchimp) with ESMTP id 4gpbZw5V7SzDRSxHb for <admin@k-in.co.jp>; Mon, 29 Jun 2026 06:14:16 +0000 (UTC) From: notification@community.spamhaus.org Subject: =?utf-8?Q?Spamhaus=20Community=20Portal:=20Verify=20Email=20Address?= Received: from [18.205.122.226] by mandrillapp.com id 53a063d7f0f8443a9a49880cb71d2da8; Mon, 29 Jun 2026 06:14:16 +0000 |
DKIMをnotification@community.spamhaus.orgとmandrillapp.comの両者を確認している。
amavisd-newがチェックして
X-Virus-Scanned: amavisd-new at k-in.co.jp
X-Spam-Flag: NO
X-Spam-Score: 1.133
X-Spam-Level: *
X-Spam-Status: No, score=1.133 tagged_above=-2 required=6.2
としてウイルス入りでもspamでも無いとしている。
といったところ。
とても綺麗な流れだったので、参考にに書いておこうと思ったのです。