relay issue

I am looking for a simliar shut off of the authrelay We have been blacklisted because of a relay of spam from a domain that I DELETED. So this spoofing is probably part of the "please let the communists control ICANN campaign" But getting blacklisted is causing outgoing mails to end up dead.

 

It's probably a result of one of your users having a hijacked email account. You need to search your /var/log/exim_mainlog.

Do something like this [and I"m sure there are more efficient ways to do this]:

grep '211\.44\.xx0\.xxx' /var/log/exim_mainlog|grep courier_login
or
grep '211.44.xx0.xxx' /var/log/exim_mainlog|grep courier_login


Then look for the email account that the spammer authenticated into in order to relay the spam:

A=courier_login:some-email@someaddress.ext

m