Warning: 200 emails have just been sent by unknown

Enter Your Query:
Use '%' for wildcards and quotes for "exact phrases"

Top Level » Email » Spam
Top Level » Email » Exim

Warning: 200 emails have just been sent by unknownLast Modified: Apr 9, 2013, 12:36 am
The "unknown" username will show up when the DA account cannot be determined from the sender address.   Most of the time, this happens when a bounce email is being sent from your server, outbound to an external location, as the sender in those cases is "<>".

This tends to result from local forwarders sending mail to external locations, but the external location refuses to accept the message (either full mailbox, doesn't exist, it thinks it's spam, etc...).  Exim is then stuck with the message that cannot be sent, thus sends the bounce message back to the external sender.  This would be billed against the "unknown" case.  Note that a bounce is not generated if an account doesn't exists locally, as the message would have never been accepted in the first place.  They only happen when the message was already accepted by exim (usually because the forwarder exists locally), but the final delivery fails.

With the newer versions of /etc/exim.pl, it has the ability to limit on a per-user basis.  With feature you can chose what you want these bounces to do. You have 3 options:

1) Allow unlimited bounces to be sent outbound.  To do this, set a higher limit for the unknown case:

echo 0 > /etc/virtual/limit_unknown

This will be the default 1.38.1+

2) Allow a higher limit for unknown.   This still allows for bounces to be sent, but also helps prevents backscatter (adjust value as needed):

echo 1000 > /etc/virtual/limit_unknown

IMPORTANT: If you set a numerical limit for /etc/virtual/limit_unknown, a "sender_verify" in the exim.conf does get counted against this limit.
So if you use the sender_verify option, make sure you leave this at 0, else all inbound emails will quickly eat up the 1000 message limit.

3) Block all bounces from leaving your server:

Note that bounces are a normal part of the mail system (RFCs), but can also be a problem (backscatter).
Each Admin will have a different opinion about what the action should be for these cases.
Related Helpfiles
How to limit the number of emails sent by each user (prevent spammer)
How to prevent bounce emails from leaving your server
SPAM fighting tools in DirectAdmin

© 2018 JBMC Software, Suite 173  3-11 Bellerose Drive, St Albert, AB  T8N 1P7  Canada.  Mon-Fri 9AM-5PM MST