[pfx] Re: empty from envelope?

> On Jun 5, 2026, at 2:07 PM, Jim Seymour via Postfix-users <[email protected]> wrote:
> 
> On Fri, 5 Jun 2026 10:47:33 -0700
> Jim Garrison via Postfix-users <[email protected]> wrote:
> 
>> On 6/4/2026 14:18, Charles Sprickman via Postfix-users wrote:
>>> Hi all,  
>> [snip]
>> 
>>> Received: from [10.88.0.3]
>>> (166.161.185.35.bc.googleusercontent.com [35.185.161.166])  
>> 
>> It is extremely unlikely that any legitimate email originates at 
>> googleusercontent.com.
> 
> That is the conclusion I'm reaching.
> 
> From my pflogsumm report for yesterday:
> 
> message reject detail
> ---------------------
>  RCPT
>    blocked using zen.spamhaus.org (12)
>           2   googleusercontent.com  (< [email protected])
>           2   googleusercontent.com  (< <>)
>           1   host.inseratex.ch  (< [email protected])
>           1   googleusercontent.com  (< [email protected])
>           1   googleusercontent.com  (< [email protected])
>           1   googleusercontent.com  (< [email protected])
>           1   googleusercontent.com  (< [email protected])
>           1   googleusercontent.com  (< [email protected])
>           1   riverhaul.com  (< [email protected])
>           1   mail3.ablluresistemas.ink  (< [email protected])
> 
> This pattern has become essentially a daily occurrence.

So outside of the whole "empty from" thing, this is just another "onmicrosoft.com" situation it seems.

I blocked that some time ago and have seen no ill effects.

Here's some random stats, and it's just so sad how much is dropped right at the front door:

 177831   rejected (88%)

And my ever growing list of garbage TLDs:

Sender address rejected: mail from this TLD not accepted (total: 29041)
 *plus*
Sender address rejected: maybe check later? (total: 135561) <- I am being a dick and give these extra-annoying ones a 4xx

And I think I might have fodder for another question for this list here:

  postscreen (total: 1651)
      1539   psc_dnsbl_request: connect to private/dnsblog service: Connecti...  <<-- ?? google not at all helpful here - I have no limits in master.cf on dnsblog procs
       100   dnsblog reply timeout 10s for dnsbl.ascams.com

And it looks like I need to get a new pflogsumm, because I want those postscreen stats! :)

Thanks for the input, much appreaciated.

Charles


> 
> I considered listing googleusercontent.com locally, but since SH is
> getting the stuff, anyway ¯\_(ツ)_/¯
> 
> Regards,
> Jim
> -- 
> Note: My mail server employs *very* aggressive anti-spam
> filtering.  If you reply to this email and your email is
> rejected, please accept my apologies and let me know via my
> web form at <http://athena.LinxNet.com/contact/scform.php>.
> _______________________________________________
> Postfix-users mailing list -- [email protected]
> To unsubscribe send an email to [email protected]

_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]