SOLVED Lots of mail with no sender address

[Paul Ward]

Hi Guys,

I recently became the admin for our companies cPanel server, mostly it plods along with no issues and I've not had to do to much but it looks like I need to investigate an issue that keeps coming back and needs a proper solution.

If I run the following cmd on my server I get back the top 5 results of emails sorted by the recipient.
# exim -bpr | egrep '^[[:space:]]{,3}[[:digit:]]' | awk '{print $4;}' | sort | uniq -c | sort -nr | head -5
1651 <>
4 <[email protected]>
1 <[email protected]>
1 <[email protected]>
1 <[email protected]>

I see 1651 message that seem to have no senders.

This is one of the headers:

mailnull 47 12
<>
1480597551 0
-ident mailnull
-received_protocol local
-body_linecount 208
-max_received_linelength 160
-allow_unqualified_recipient
-allow_unqualified_sender
-frozen 1480597551
-localerror
XX
1
[email protected]

160P Received: from mailnull by shost02with local (Exim 4.86                                                                                                                _1)
        id 1cCR3f-000828-4T
        for [email protected]; Thu, 01 Dec 2016 13:05:51 +0000
055  X-Failed-Recipients: [email protected]
029  Auto-Submitted: auto-replied
070F From: Mail Delivery System <[email protected]>
026T To: [email protected]
099  Content-Type: multipart/report; report-type=delivery-status; boundary=14805                                                                                                                97551-eximdsn-200917962
018  MIME-Version: 1.0
059  Subject: Mail delivery failed: returning message to sender
059I Message-Id: <[email protected]
038  Date: Thu, 01 Dec 2016 13:05:51 +0000

At this point I am unsure how to proceed, sure I can remove them all as I have in the past but I'd to try and find out whats causing this, how do I go about this?

Thanks
Paul

 

[cPanelMichael]

Hello,

The following thread is a good place to start when attempting to determine the source of those messages:

Spam emails being sent from cPanel account

Thank you.