Re: [Nmh-workers] Every Three Minutes

[Ken Hornstein]

>Every three minutes I get mail like the forwarded message
>below. Rebooting didn't stop the deluge.  What can I do to stop them.

So, my $0.02 ... does anyone else find these Received headers odd?
Specifically ...

>Return-Path: <address@hidden>

Looks like it's rawbw.com that's complaining, buuutttt ....

>Delivered-To: address@hidden
>Received: from lad.dad.org (localhost [IPv6:::1])
>       by lad.dad.org (Postfix) with ESMTP id 9E3B06036D
>       for <address@hidden>; Sat,  2 Feb 2013 08:32:11 -0800 (PST)
>X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail1.rawbw.com
>X-Spam-Level:
>X-Spam-Status: No, score=-0.0 required=5.0 tests=SPF_HELO_PASS
>       autolearn=disabled version=3.3.1
>Received: from imap.rawbw.com [198.144.192.43]
>       by lad.dad.org with IMAP (fetchmail-6.3.17)
>       for <address@hidden> (single-drop); Sat, 02 Feb 2013 08:32:11 -0800 
> (PST)
>Received: from ns2.adzone.com (ns2.adzone.com [96.247.50.174])
>       by mail1.rawbw.com (8.14.2/8.14.2) with ESMTP id r12GTBUi043071
>       for <address@hidden>; Sat, 2 Feb 2013 08:29:16 -0800 (PST)
>Received: from lad.dad.org ([198.144.207.170])
>       by ns2.adzone.com (8.14.5/8.14.5) with ESMTP id r12GS9Vl086148
>       for <address@hidden>; Sat, 2 Feb 2013 08:28:09 -0800
>Received: from lad.dad.org (localhost [IPv6:::1])
>       by lad.dad.org (Postfix) with SMTP id EC3AC6035A
>       for <address@hidden>; Sat,  2 Feb 2013 08:29:10 -0800 (PST)

Reading bottom up, the bounce goes from lad.dad.org, to ns2.adzone.com, to
mail1.rawbw.com, back to lad.dad.org.  ?

>Subject: Mail delivery failed: returning message to sender
>From: Mail Delivery System <address@hidden>

And the From line doesn't agree with the Return-Path.

Hm, okay, I _think_ I see it.  The problem isn't sending to your original
recipient, it's with the cc to yourself.  And adzone.com is your MX record,
so that explains the received headers.  But I don't know why it kept
happening.  And I'm a little puzzled how rawbw.com got into the mix.

See, Norm?  _This_ is why you should use Fcc! :-)

--Ken