search

mailcow / mailcow-dockerized

mailcow: dockerized - 🐮 + 🐋 = 💕
https://mailcow.email
GNU General Public License v3.0
8.92k stars 1.17k forks source link

Anonymize Headers does not work #984

Closed ddefosse closed 6 years ago

ddefosse commented 6 years ago

How anonymize header ?

I followed this guide but it does not work

To disguise your users details like IP, email client, etc. we have to create a new file in data/conf/postfix/mailcow_anonymize_headers.pcre and insert the following:

/^\s*Received:[^\)]+\)\s+\(Authenticated sender:(.+)/
    REPLACE Received: from localhost (localhost [127.0.0.1]) (Authenticated sender:$1
/^\s*User-Agent/        IGNORE
/^\s*X-Enigmail/        IGNORE
/^\s*X-Mailer/          IGNORE
/^\s*X-Originating-IP/  IGNORE
/^\s*X-Forward/         IGNORE

Next we need to add the following to data/conf/postfix/main.cf:

smtp_header_checks = pcre:/opt/postfix/conf/mailcow_anonymize_headers.pcre

should we do something else?

stevesbrain commented 6 years ago

@ddefosse After doing this, did you reload all the containers?

ddefosse commented 6 years ago

yes but my mail is always rejected by orange

host smtp-in.orange.fr[80.12.242.9] said: 550
    5.2.0 Mail rejete. Mail rejected. ofr_506 [506] (in reply to end of DATA
    command)
Reporting-MTA: dns; 
X-Postfix-Queue-ID: C1FA63EF66
X-Postfix-Sender: rfc822; 
Arrival-Date: Wed, 31 Jan 2018 23:35:45 +0100 (CET)
Final-Recipient: rfc822; xxx@orange.fr
Original-Recipient: rfc822;xxx@orange.fr
Action: failed
Status: 5.2.0
Remote-MTA: dns; smtp-in.orange.fr
Diagnostic-Code: smtp; 550 5.2.0 Mail rejete. Mail rejected. ofr_506 [506]
stevesbrain commented 6 years ago

The fact that orange.fr is rejecting your mail doesn't mean your headers aren't anonymized. When you send to a host that doesn't reject you, what do your headers look like?

ddefosse commented 6 years ago

my header

Return-Path: <xxx>

Received: from mwinf5c24 (mwinf5c24 [10.223.111.74])
by mwinb1k02 with LMTPA;
Thu, 01 Feb 2018 01:51:34 +0100

X-Sieve: CMU Sieve 2.3

Received: from xx ([xx])
by mwinf5c24 with ME
id 5CrX1x00Z0PdJSt01CrX19; Thu, 01 Feb 2018 01:51:31 +0100

X-bcc: xx

X-ME-bounce-domain: orange.fr

X-ME-engine: default

X-me-spamcause: (290)(1000)gggruggvucftvghtrhhoucdtuddrgedtfedrtdefgddvieculddtuddrgedtvddrtddtmdcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfogfd
pggftiffpkfenuceurghilhhouhhtmecugedttdenucgorfhhihhshhhinhhgqdfkphculdeftddtmdenjfgrmhfjvggruggvrhfhihgvlhguucfjvggruggvrhcuufgto
hhrihhnghculddquddtmdenucfjughrpeffuffhvffkfhgjgggtsegrtdhmredttdejnecuhfhrohhmpeffvghfohhsshgvucffrghmihgvnhcuoeguuggvfhhoshhsvge
skhhoohgsvghtohdrtghomheqnecukfhppeeghedrjeejrdeifedrudeknecurfgrrhgrmhephhgvlhhopehmgidrkhhoohgsvghtohdrfhhrpdhinhgvthepgeehrdejj
edrieefrddukedpmhgrihhlfhhrohhmpeguuggvfhhoshhsvgeskhhoohgsvghtohdrtghomhdprhgtphhtthhopegurghmihgvnhdruggvfhhoshhsvgegsehorhgrnhh
gvgdrfhhrnecuvehluhhsthgvrhfuihiivgeptd

X-me-spamlevel: low

X-ME-Helo: xx

X-ME-IP: xx

X-ME-Entity: ofr

Received: (Authenticated sender: xx)
by xxr (Postfix) with ESMTPSA id 1A6033EF68
for <xx>; Thu,  1 Feb 2018 01:51:31 +0100 (CET)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=xx.com; s=dkim;
t=1517446291;
h=from:sender:reply-to:subject:date:message-id:to:cc:mime-version:content-type:content-transfer-encoding:resent-to:resent-cc:resent-from:resent-sender:resent-message-id:in-reply-to:references:list-id:list-owner:list-unsubscribe:list-subscribe:list-post;
bh=RI+hZ7700ETr/mNoHTlq6PD2wcaciDz3wXZA6gr5Qtc=;
b=DeyFgpyTxzfBGZ0j66CmJQ8u8sMExKwoJN2joQpZswISt5FHDa91feHGTKjUqe2+URyGjX
3yqEIEPSlYmyqKfUowlZW71yFeNp6WU/cWnLOzRTXYUe9rxnOGB+Wq5WenXnJpnT0atHLu
gCdVC4woRUyJeDAr9b3C5sfPeVvYGSgR9VgxTnBxd1XEooBnpNokLWSR7t89gdCcsDOrJ7
FgqR76OuIDU+hZHzwIlQyS2RNo0zOgT9PCTH5KgVvUps4ECpcfYdicHfkp6EtFYc9uB+nN
QwRsoRmCi7gp73OnAdwojdXUbnqkpfszaDDVRsqWUo4D3TvhoItG2LjCrVszxQ==

Date: Thu, 01 Feb 2018 01:51:29 +0100

Subject: Re: xx

From: xx xx <xx>

To: xx xx <xx>

Message-ID: <B522BAA2-C23F-4B6E-9FC8-E28DC9E0056C@xx.com>

Thread-Topic: xx

References: <E4355B53-1302-46DE-88DF-D7C7A552C4B8@xx.com>
<807322612.19738.1517438012769.JavaMail.www@wwinf1d03>

In-Reply-To: <807322612.19738.1517438012769.JavaMail.www@wwinf1d03>

Mime-version: 1.0

Content-type: multipart/alternative;
boundary="B_3600294691_1935913691"

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=xx.com;
s=dkim; t=1517446291;
h=from:sender:reply-to:subject:date:message-id:to:cc:mime-version:content-type:content-transfer-encoding:resent-to:resent-cc:resent-from:resent-sender:resent-message-id:in-reply-to:references:list-id:list-owner:list-unsubscribe:list-subscribe:list-post;
bh=RI+hZ7700ETr/mNoHTlq6PD2wcaciDz3wXZA6gr5Qtc=;
b=bmbkvqAU1HyjM4mAub+4Vf7hC0skb2722qiJqZYPcYr5I0MHg/v8QnYyZ3BAyIBq0E9KJk
oqZk3qU5PTcZiW7Qp0DaQcUnsawazr0Xu6VEKep8viPi1ktcOwkqqXscUOttyd9WiG1rSY
8AlrqtBp8Zz08NY2xi0w9El2i7nJ5HDnKGouXKTSAuQg+3do7WcldaN1/L1++oDLA8M8yK
6lmGaQyOmNWxk/7p3kac/EN6spBD+437q8c8gYmPZpCIWxdA2Aksem03Xcl6/1sIz6oKAH
3bnA7rnpw/RmNohGHEx9dxK1WG7NhiCVVivXWgPxrfIggur1dKZkUnw/1ySCzQ==

ARC-Seal: i=1; s=dkim; d=xx.com; t=1517446291; a=rsa-sha256; cv=none;
b=lXm6Ssc/vp5yKKGo/VlKhG/cIzcJJSDVjAvm119rInETO/ozgIlyc3HKcprsGGXu6elL72rG8FhX7XYjCxwjyNXiF6Erw0Ok1PrluLY7l9aBa/AMXrGG2+7TRQsv5Eb
g+4yxon2E3MYjx/XH2dd+juYai7yyL+EVtFqukZqkZQNds6DQpnYGprgsShjGbPj79GnMXVcgexhudveoilV+YLDb9+z+N7jskb0YfGlQo3U/X9Isk57tUg9v6xUsz1pCT
cSnpo0xuPqnOytV+wq937gBCMP+M2JIlyiQ9mdOvTLk3q4Ay3tDIsYClp/DNZKCS0ppDkwRINQn/9JUUUAeEw==

ARC-Authentication-Results: i=1; auth=pass smtp.auth=xx@xx.com
smtp.mailfrom=xx@xx.com

X-me-spamwebmail: HAM
stevesbrain commented 6 years ago

Does appear to be anonymizing correctly - all of the fields you've stripped out do not appear in your headers (X-Originating-IP for example)

ddefosse commented 6 years ago

ok but why my email is rejected it does not even get into spam

stevesbrain commented 6 years ago

You'd have to ask orange.fr that question. I'd start with basic troubleshooting though:

That kinda stuff :)

andryyy commented 6 years ago

It is rejecting based on your servers IP. You cannot hide a ISPs network by removing headers. Some ISPs just don't care that much about their IP reputation.

ddefosse commented 6 years ago

thank you for all your clarifications. but what I do not understand is why the mail is accepted via the webmail and refused via outlook?

andryyy commented 6 years ago

You may be using port 25. Use port 587 or 465. :-)

ddefosse commented 6 years ago

unfortunately unfortunately outlook was already configured in 587, I just tested in 465 but without success :(

Lucky88888 commented 6 years ago

check your used public IP adreses against DNSBL. If it is appearing there clear your IP reputation.

ddefosse commented 6 years ago

reputation seems ok :

  Blacklist Reason TTL ResponseTime  
OK Abuse.ro     170  
OK ASPEWS     47  
OK BACKSCATTERER     36  
OK BARRACUDA     65  
OK BBFHL1     47  
OK BBFHL2     46  
OK BLOCKLIST.DE     44  
OK BSB     67  
OK CALIVENT     45  
OK CASA CBL     37  
OK CASA CDL     312  
OK CBL     162  
OK CYMRU BOGONS     39  
OK DAN TOR     259  
OK DAN TOREXIT     258  
OK DNS Realtime Blackhole List     47  
OK DNS SERVICIOS     144  
OK DRMX     257  
OK DRONE BL     149  
OK DULRU     176  
OK FABELSOURCES     66  
OK HIL     39  
OK HIL2     40  
OK Hostkarma Black     102  
OK IBM DNS Blacklist     119  
OK ICMFORBIDDEN     147  
OK IMP SPAM     35  
OK IMP WORM     37  
OK INPS_DE     53  
OK INTERSERVER     46  
OK IPrange RBL Project     136  
OK ivmSIP     42  
OK ivmSIP24     35  
OK JIPPG     219  
OK KEMPTBL     39  
OK KISA     244  
OK Konstant     116  
OK LASHBACK     36  
OK LNSGBLOCK     47  
OK LNSGBULK     40  
OK LNSGMULTI     39  
OK LNSGOR     40  
OK LNSGSRC     39  
OK MADAVI     137  
OK MailBlacklist     36  
OK MAILSPIKE BL     119  
OK MAILSPIKE Z     112  
OK MEGARBL     114  
OK MSRBL Phishing     97  
OK MSRBL Spam     118  
OK NETHERRELAYS     41  
OK NETHERUNSURE     40  
OK NIXSPAM     143  
OK NoSolicitado     42  
OK ORVEDB     203  
OK OSPAM     74  
OK PSBL     36  
OK RATS Dyna     71  
OK RATS NoPtr     73  
OK RATS Spam     70  
OK RBL JP     48  
OK RSBL     180  
OK SCHULTE     54  
OK SECTOOR EXITNODES     61  
OK SEM BACKSCATTER     56  
OK SEM BLACK     56  
OK Sender Score Reputation Network     36  
OK SERVICESNET     72  
OK SORBS BLOCK     38  
OK SORBS DUHL     35  
OK SORBS HTTP     37  
OK SORBS MISC     37  
OK SORBS NEW     36  
OK SORBS SMTP     36  
OK SORBS SOCKS     35  
OK SORBS SPAM     38  
OK SORBS WEB     36  
OK SORBS ZOMBIE     37  
OK SPAMCOP     44  
OK Spamhaus ZEN     36  
OK SPEWS1     39  
OK SPEWS2     40  
OK Suomispam Reputation     146  
OK SWINOG     37  
OK TRIUMF     59  
OK TRUNCATE     42  
OK UCEPROTECTL1     37  
OK UCEPROTECTL2     35  
OK UCEPROTECTL3     43  
OK VIRBL     136  
OK Woodys SMTP Blacklist     38  
OK WPBL     37  
OK ZapBL     117  
OK Abuse.ro     170  
OK ASPEWS     47  
OK BACKSCATTERER     36  
OK BARRACUDA     65  
OK BBFHL1     47  
OK BBFHL2     46  
OK BLOCKLIST.DE     44  
OK BSB     67  
OK CALIVENT     45  
OK CASA CBL     37  
OK CASA CDL     312  
OK CBL     162  
OK CYMRU BOGONS     39  
OK DAN TOR     259  
OK DAN TOREXIT     258  
OK DNS Realtime Blackhole List     47  
OK DNS SERVICIOS     144  
OK DRMX     257  
OK DRONE BL     149  
OK DULRU     176  
OK FABELSOURCES     66  
OK HIL     39  
OK HIL2     40  
OK Hostkarma Black     102  
OK IBM DNS Blacklist     119  
OK ICMFORBIDDEN     147  
OK IMP SPAM     35  
OK IMP WORM     37  
OK INPS_DE     53  
OK INTERSERVER     46  
OK IPrange RBL Project     136  
OK ivmSIP     42  
OK ivmSIP24     35  
OK JIPPG     219  
OK KEMPTBL     39  
OK KISA     244  
OK Konstant     116  
OK LASHBACK     36  
OK LNSGBLOCK     47  
OK LNSGBULK     40  
OK LNSGMULTI     39  
OK LNSGOR     40  
OK LNSGSRC     39  
OK MADAVI     137  
OK MailBlacklist     36  
OK MAILSPIKE BL     119  
OK MAILSPIKE Z     112  
OK MEGARBL     114  
OK MSRBL Phishing     97  
OK MSRBL Spam     118  
OK NETHERRELAYS     41  
OK NETHERUNSURE     40  
OK NIXSPAM     143  
OK NoSolicitado     42  
OK ORVEDB     203  
OK OSPAM     74  
OK PSBL     36  
OK RATS Dyna     71  
OK RATS NoPtr     73  
OK RATS Spam     70  
OK RBL JP     48  
OK RSBL     180  
OK SCHULTE     54  
OK SECTOOR EXITNODES     61  
OK SEM BACKSCATTER     56  
OK SEM BLACK     56  
OK Sender Score Reputation Network     36  
OK SERVICESNET     72  
OK SORBS BLOCK     38  
OK SORBS DUHL     35  
OK SORBS HTTP     37  
OK SORBS MISC     37  
OK SORBS NEW     36  
OK SORBS SMTP     36  
OK SORBS SOCKS     35  
OK SORBS SPAM     38  
OK SORBS WEB     36  
OK SORBS ZOMBIE     37  
OK SPAMCOP     44  
OK Spamhaus ZEN     36  
OK SPEWS1     39  
OK SPEWS2     40  
OK Suomispam Reputation     146  
OK SWINOG     37  
OK TRIUMF     59  
OK TRUNCATE     42  
OK UCEPROTECTL1     37  
OK UCEPROTECTL2     35  
OK UCEPROTECTL3     43  
OK VIRBL     136  
OK Woodys SMTP Blacklist     38  
OK WPBL     37  
OK ZapBL     117  
TIMEOUT Anonmails DNSBL     0 Ignore
andryyy commented 6 years ago

Online.net OVH and such are blacklisted by most providers. You will not find them on lists below.

You cannot change anything to make orange accept your IP besides writing them. I won’t recommend those ISPs for anything mail related.

Am 01.02.2018 um 14:34 schrieb ddefosse notifications@github.com:

reputation seems ok :

Blacklist Reason TTL ResponseTime
OK Abuse.ro 170
OK ASPEWS 47
OK BACKSCATTERER 36
OK BARRACUDA 65
OK BBFHL1 47
OK BBFHL2 46
OK BLOCKLIST.DE 44
OK BSB 67
OK CALIVENT 45
OK CASA CBL 37
OK CASA CDL 312
OK CBL 162
OK CYMRU BOGONS 39
OK DAN TOR 259
OK DAN TOREXIT 258
OK DNS Realtime Blackhole List 47
OK DNS SERVICIOS 144
OK DRMX 257
OK DRONE BL 149
OK DULRU 176
OK FABELSOURCES 66
OK HIL 39
OK HIL2 40
OK Hostkarma Black 102
OK IBM DNS Blacklist 119
OK ICMFORBIDDEN 147
OK IMP SPAM 35
OK IMP WORM 37
OK INPS_DE 53
OK INTERSERVER 46
OK IPrange RBL Project 136
OK ivmSIP 42
OK ivmSIP24 35
OK JIPPG 219
OK KEMPTBL 39
OK KISA 244
OK Konstant 116
OK LASHBACK 36
OK LNSGBLOCK 47
OK LNSGBULK 40
OK LNSGMULTI 39
OK LNSGOR 40
OK LNSGSRC 39
OK MADAVI 137
OK MailBlacklist 36
OK MAILSPIKE BL 119
OK MAILSPIKE Z 112
OK MEGARBL 114
OK MSRBL Phishing 97
OK MSRBL Spam 118
OK NETHERRELAYS 41
OK NETHERUNSURE 40
OK NIXSPAM 143
OK NoSolicitado 42
OK ORVEDB 203
OK OSPAM 74
OK PSBL 36
OK RATS Dyna 71
OK RATS NoPtr 73
OK RATS Spam 70
OK RBL JP 48
OK RSBL 180
OK SCHULTE 54
OK SECTOOR EXITNODES 61
OK SEM BACKSCATTER 56
OK SEM BLACK 56
OK Sender Score Reputation Network 36
OK SERVICESNET 72
OK SORBS BLOCK 38
OK SORBS DUHL 35
OK SORBS HTTP 37
OK SORBS MISC 37
OK SORBS NEW 36
OK SORBS SMTP 36
OK SORBS SOCKS 35
OK SORBS SPAM 38
OK SORBS WEB 36
OK SORBS ZOMBIE 37
OK SPAMCOP 44
OK Spamhaus ZEN 36
OK SPEWS1 39
OK SPEWS2 40
OK Suomispam Reputation 146
OK SWINOG 37
OK TRIUMF 59
OK TRUNCATE 42
OK UCEPROTECTL1 37
OK UCEPROTECTL2 35
OK UCEPROTECTL3 43
OK VIRBL 136
OK Woodys SMTP Blacklist 38
OK WPBL 37
OK ZapBL 117
OK Abuse.ro 170
OK ASPEWS 47
OK BACKSCATTERER 36
OK BARRACUDA 65
OK BBFHL1 47
OK BBFHL2 46
OK BLOCKLIST.DE 44
OK BSB 67
OK CALIVENT 45
OK CASA CBL 37
OK CASA CDL 312
OK CBL 162
OK CYMRU BOGONS 39
OK DAN TOR 259
OK DAN TOREXIT 258
OK DNS Realtime Blackhole List 47
OK DNS SERVICIOS 144
OK DRMX 257
OK DRONE BL 149
OK DULRU 176
OK FABELSOURCES 66
OK HIL 39
OK HIL2 40
OK Hostkarma Black 102
OK IBM DNS Blacklist 119
OK ICMFORBIDDEN 147
OK IMP SPAM 35
OK IMP WORM 37
OK INPS_DE 53
OK INTERSERVER 46
OK IPrange RBL Project 136
OK ivmSIP 42
OK ivmSIP24 35
OK JIPPG 219
OK KEMPTBL 39
OK KISA 244
OK Konstant 116
OK LASHBACK 36
OK LNSGBLOCK 47
OK LNSGBULK 40
OK LNSGMULTI 39
OK LNSGOR 40
OK LNSGSRC 39
OK MADAVI 137
OK MailBlacklist 36
OK MAILSPIKE BL 119
OK MAILSPIKE Z 112
OK MEGARBL 114
OK MSRBL Phishing 97
OK MSRBL Spam 118
OK NETHERRELAYS 41
OK NETHERUNSURE 40
OK NIXSPAM 143
OK NoSolicitado 42
OK ORVEDB 203
OK OSPAM 74
OK PSBL 36
OK RATS Dyna 71
OK RATS NoPtr 73
OK RATS Spam 70
OK RBL JP 48
OK RSBL 180
OK SCHULTE 54
OK SECTOOR EXITNODES 61
OK SEM BACKSCATTER 56
OK SEM BLACK 56
OK Sender Score Reputation Network 36
OK SERVICESNET 72
OK SORBS BLOCK 38
OK SORBS DUHL 35
OK SORBS HTTP 37
OK SORBS MISC 37
OK SORBS NEW 36
OK SORBS SMTP 36
OK SORBS SOCKS 35
OK SORBS SPAM 38
OK SORBS WEB 36
OK SORBS ZOMBIE 37
OK SPAMCOP 44
OK Spamhaus ZEN 36
OK SPEWS1 39
OK SPEWS2 40
OK Suomispam Reputation 146
OK SWINOG 37
OK TRIUMF 59
OK TRUNCATE 42
OK UCEPROTECTL1 37
OK UCEPROTECTL2 35
OK UCEPROTECTL3 43
OK VIRBL 136
OK Woodys SMTP Blacklist 38
OK WPBL 37
OK ZapBL 117
TIMEOUT Anonmails DNSBL 0 Ignore — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

andryyy commented 6 years ago

Closing this as not mailcow related.