mailqueue shows bounces for emails that are not on the mailing list
Iam getting alot of such from my mail server mail queue lately4d08rT4xMHzMCD6S 2393 Mon Nov 3 01:43:21 list-bounces+makeupbymichelle=aol.com@lists.mydomain(host mx-aol.mail.gm0.yahoodns.net[67.195.228.84] said: 421 4.7.0 [TSS04] Messages from my-mail-server-IP temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes (in reply to MAIL FROM command))makeupbymichelle@aol.com 4d0GJJ3TLhzMCDHH 2378 Mon Nov 3 05:49:20 list2-bounces+lolaann09=yahoo.com@lists.mydomain(host mta5.am0.yahoodns.net[67.195.228.94] said: 421 4.7.0 [TSS04] Messages from my-mail-server-IP temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes (in reply to MAIL FROM command))lolaann09@yahoo.comThis is becoming problematic because am currently being blocked on Yahoo domains. My setup is as follows: I host mailman3 list server which uses our mail server as a relay.The spam emails i.e makeupbymichelle@aol.com and lolaann09@yahoo.com are neither members nor non members of the lists which are generating the bounces.I have also confirmed that none of the list members are forwarding to any of those spam addresses.What am I missing?Thank you.
Paul via Mailman-users writes:
Iam getting alot of such from my mail server mail queue lately 4d08rT4xMHzMCD6S 2393 Mon Nov 3 01:43:21 list-bounces+makeupbymichelle=aol.com@lists.mydomain (host mx-aol.mail.gm0.yahoodns.net[67.195.228.84] said: 421 4.7.0 [TSS04] Messages from my-mail-server-IP temporarily deferred due to unexpected volume or user complaints - 4.16.55.1
If "my-mail-server-IP" is in fact your mail server's IP, then you may have a problem: spammers may be using your server as a relay for spoofed emails.
Are these the only entries for those messages in your logs when your system contacts the Yahoo MTAs? It may be useful to increase the verbosity of the MTA's logging if so. Also double-check whether these events seem to be correlated with any entries in the Mailman logs.
This is becoming problematic because am currently being blocked on Yahoo domains.
This is the natural result if your server is being abused in that way.
Are you seeing similar events for non-Yahoo-managed recipients? If not that's pretty strange.
My setup is as follows: I host mailman3 list server which uses our mail server as a relay.
Do you manage the mail server itself? What software do you use for your MTA (Postfix, Exim4, Sendmail, qmail are common MTAs).
Does your MTA allow relaying from other hosts? This includes accepting submissions from remote logged-in users (usually port 587, the submission service, but sometimes port 465, smpts/ssmtp)? (Mailman is *not* a relay according to the definition used in the email system. It involves accepting the message, processing it locally, and *reinjecting* the message into the Internet mail system. In a relay, the message gets no local processing outside the MTA itself, and is immediately forwarded on to the "next hop".)
Try to correlate these bounces with incoming messages, including from logged-in users (either local shell users or remote via authenticated mail). Perhaps you can block their sources, although spammers usually use botnets to frustrate that kind of defense. If you can't find the source, that's a big problem.
What kind of user accounts with shell login access are present on your mail server? (Generally we advise limiting these to root and a small number of personal accounts for host admins.) Shell access should be SSH-only, using public key authentication. Are there any suspicious logins around the times the spam messages are known to have been sent to Yahoo?
For future reference, answers to the below may be helpful in deciding what you can do to frustrate the spammers.
Is Mailman used for business communication, or are these messages within a discussion group? What other mail flows does your server handle (ie, personal to/from for members of your organization, business marketing, business transactions including customer support, other)?
Do you have SPF set up for your server's IP?
Do you have DKIM set up for your server's domain(s)?
Steve
-- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan
On 11/3/25 04:18, Stephen J. Turnbull wrote:
Paul via Mailman-users writes:
Iam getting alot of such from my mail server mail queue lately 4d08rT4xMHzMCD6S 2393 Mon Nov 3 01:43:21 list-bounces+makeupbymichelle=aol.com@lists.mydomain (host mx-aol.mail.gm0.yahoodns.net[67.195.228.84] said: 421 4.7.0 [TSS04] Messages from my-mail-server-IP temporarily deferred due to unexpected volume or user complaints - 4.16.55.1
If "my-mail-server-IP" is in fact your mail server's IP, then you may have a problem: spammers may be using your server as a relay for spoofed emails.
It is also possible, or even likely that these are the result of bad actors maliciously requesting subscriptions for 3rd parties. Since this is a 421 status, these mails should remain queued in your mail server for a while and can be examined[1]. If this is the case, you may be able to mitigate this by setting
SHOW_ANONYMOUS_SUBSCRIBE_FORM = False
in your Django settings. See https://docs.mailman3.org/projects/postorius/en/latest/news.html#news-1-3-9
[1] For example if your MTA is Postfix
postcat /var/spool/deferred/4/4d08rT4xMHzMCD6S
and if that shows a subscription or email verification request
postsuper -d 4d08rT4xMHzMCD6S
to delete it so it isn't retried.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
If "my-mail-server-IP" is in fact your mail server's IP, then you may have a problem: spammers may be using your server as a relay for spoofed emails. It is also possible, or even likely that these are the result of bad actors maliciously requesting subscriptions for 3rd parties. Since this is a 421 status, these mails should remain queued in your mail server for a while and can be examined[1]. If this is the case, you may be able to mitigate this by setting SHOW_ANONYMOUS_SUBSCRIBE_FORM = False in your Django settings. See https://docs.mailman3.org/projects/postorius/en/latest/news.html#news-1-3-9 [1] For example if your MTA is Postfix postcat /var/spool/deferred/4/4d08rT4xMHzMCD6S and if that shows a subscription or email verification request postsuper -d 4d08rT4xMHzMCD6S to delete it so it isn't retried.
this is most likely the case. I tried adding the setting in Django as suggested but it doesnot seem to work. I see the documentation is for Postorius 1.3.9 but my version is 1.3.8 I suppose I need to upgrade Postorius
Stephen J. Turnbull wrote:
Paul via Mailman-users writes:
Iam getting alot of such from my mail server mail queue lately 4d08rT4xMHzMCD6S 2393 Mon Nov 3 01:43:21 list-bounces+makeupbymichelle=aol.com@lists.mydomain (host mx-aol.mail.gm0.yahoodns.net[67.195.228.84] said: 421 4.7.0 [TSS04] Messages from my-mail-server-IP temporarily deferred due to unexpected volume or user complaints - 4.16.55.1 If "my-mail-server-IP" is in fact your mail server's IP, then you may have a problem: spammers may be using your server as a relay for spoofed emails. Are these the only entries for those messages in your logs when your system contacts the Yahoo MTAs? It may be useful to increase the verbosity of the MTA's logging if so. Also double-check whether these events seem to be correlated with any entries in the Mailman logs. This is becoming problematic because am currently being blocked on Yahoo domains. This is the natural result if your server is being abused in that way. Are you seeing similar events for non-Yahoo-managed recipients? If not that's pretty strange. My setup is as follows: I host mailman3 list server which uses our mail server as a relay.
Do you manage the mail server itself? What software do you use for your MTA (Postfix, Exim4, Sendmail, qmail are common MTAs).
Does your MTA allow relaying from other hosts? This includes accepting submissions from remote logged-in users (usually port 587, the submission service, but sometimes port 465, smpts/ssmtp)? (Mailman is *not* a relay according to the definition used in the email system. It involves accepting the message, processing it locally, and *reinjecting* the message into the Internet mail system. In a relay, the message gets no local processing outside the MTA itself, and is immediately forwarded on to the "next hop".)
Try to correlate these bounces with incoming messages, including from logged-in users (either local shell users or remote via authenticated mail). Perhaps you can block their sources, although spammers usually use botnets to frustrate that kind of defense. If you can't find the source, that's a big problem.
What kind of user accounts with shell login access are present on your mail server? (Generally we advise limiting these to root and a small number of personal accounts for host admins.) Shell access should be SSH-only, using public key authentication. Are there any suspicious logins around the times the spam messages are known to have been sent to Yahoo?
For future reference, answers to the below may be helpful in deciding what you can do to frustrate the spammers.
Is Mailman used for business communication, or are these messages within a discussion group? What other mail flows does your server handle (ie, personal to/from for members of your organization, business marketing, business transactions including customer support, other)?
Do you have SPF set up for your server's IP?
Do you have DKIM set up for your server's domain(s)?
- strangely so far i only see Yahoo domain in the spam
- I use Postfix as the MTA
- The MTA only relays for a specific list of senders
- It is a production mail server so we have most of those controls in place i.e DKIM, SPF
- I have not identified any suspicious logins, the bad actors must be using the subscription option on my mailing lists info page
Paul Ssekamatte via Mailman-users writes:
- strangely so far i only see Yahoo domain in the spam
- I use Postfix as the MTA
- The MTA only relays for a specific list of senders
- It is a production mail server so we have most of those controls in place i.e DKIM, SPF
- I have not identified any suspicious logins, the bad actors must be using the subscription option on my mailing lists info page
OK, I would say the chances are that Mark is right. There is another channel that could cause the same effect, which is mail subscriptions to $LIST-join@$YOUR.DOMAIN (also $LIST-subscribe and $LIST-request variants on many systems).
Steve
-- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan
participants (4)
-
Mark Sapiro -
Paul -
Paul Ssekamatte
-
Stephen J. Turnbull