Zimbra 8.7.11 periodically sends lots of spam emails

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
hikauz
Posts: 6
Joined: Thu Oct 19, 2017 12:45 pm

Zimbra 8.7.11 periodically sends lots of spam emails

Postby hikauz » Tue Nov 26, 2019 7:11 am

Hi people.

We have CentOS Linux release 7.4.1708 (Core) and Release 8.7.11_GA_1854.RHEL7_64_20170531151956 RHEL7_64 FOSS edition.
domain mfa.uz
fqdn post.mfa.uz
ip 195.158.27.138
All users only use zimbra through webmail on https or zimbra desktop.
No pop3, no imap, no 3rd party mail clients


We followed zimbra wiki
https://wiki.zimbra.com/wiki/Anti-spam_Strategies
https://wiki.zimbra.com/wiki/Improving_Anti-spam_system
https://wiki.zimbra.com/wiki/Best_Pract ... _and_DMARC
https://wiki.zimbra.com/wiki/Configurin ... IM_Signing
https://wiki.zimbra.com/wiki/Rejecting_ ... _addresses
https://wiki.zimbra.com/wiki/Enforcing_ ... ername_8.5

Now we pass all tests on mxtoolbox.com and other servers for DNS, SPF, DKIM, DMARC and open relay

Unfortunately, periodically our zimbra sends a lot (10000-20000) emails per day to unknown emails. We saw it via zimbra monitor the smtp queue.
Notably that each time all emails were sent on behalf of some active user (each time different). Only changing user password and restarting zimbra helps to stop spaming.
The compromised user sense nothing (no emails in sent/outgoing folder), except thousands "delivery failed" emails coming back to spam emails

Spam emails sent from remote unknown IPs.
We suppose our server acts like open relay because remote spammers sent their bulk emails via our server to outside users (not only local)
But all online tests show we aren't open relay.

Please help us

Here some config info

Code: Select all

zmprov gacf | grep zimbraMtaRestriction
zimbraMtaRestriction: check_client_access lmdb:/opt/zimbra/conf/postfix_rbl_override
zimbraMtaRestriction: check_recipient_access lmdb:/opt/zimbra/conf/postfix_recipient_access
zimbraMtaRestriction: reject_invalid_helo_hostname
zimbraMtaRestriction: reject_non_fqdn_helo_hostname
zimbraMtaRestriction: reject_non_fqdn_sender
zimbraMtaRestriction: reject_unknown_client_hostname
zimbraMtaRestriction: reject_unknown_helo_hostname
zimbraMtaRestriction: reject_unknown_reverse_client_hostname
zimbraMtaRestriction: reject_unknown_sender_domain

[zimbra@post ~]$ postconf mynetworks
mynetworks = 127.0.0.0/8 172.30.30.179/32

zmprov gs post.mfa.uz zimbraMtaMyNetworks
# name post.mfa.uz
zimbraMtaMyNetworks: 127.0.0.0/8 172.30.30.179/32

cat /opt/zimbra/conf/zmconfigd/smtpd_sender_restrictions.cf
%%exact VAR:zimbraMtaSmtpdSenderRestrictions reject_authenticated_sender_login_mismatch%%
%%contains VAR:zimbraMtaSmtpdSenderRestrictions check_sender_access lmdb:/opt/zimbra/conf/postfix_reject_sender%%
%%contains VAR:zimbraServiceEnabled cbpolicyd^ check_policy_service inet:localhost:%%zimbraCBPolicydBindPort%%%%
%%contains VAR:zimbraServiceEnabled amavis^ check_sender_access regexp:/opt/zimbra/common/conf/tag_as_originating.re%%
permit_mynetworks
reject_sender_login_mismatch
permit_sasl_authenticated
permit_tls_clientcerts
%%contains VAR:zimbraServiceEnabled amavis^ check_sender_access regexp:/opt/zimbra/common/conf/tag_as_foreign.re%%


here the original spam emails.

Code: Select all

Received: from post.mfa.uz (LHLO post.mfa.uz) (172.30.30.179) by post.mfa.uz
 with LMTP; Mon, 25 Nov 2019 18:15:46 +0500 (UZT)
Received: by post.mfa.uz (Postfix)
   id 0A0C718083E58E; Mon, 25 Nov 2019 18:15:46 +0500 (+05)
Date: Mon, 25 Nov 2019 18:15:46 +0500 (+05)
From: MAILER-DAEMON@post.mfa.uz (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: sco@mfa.uz
Auto-Submitted: auto-replied
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
   boundary="1AE531807E4B79.1574687746/post.mfa.uz"
Message-Id: <20191125131546.0A0C718083E58E@post.mfa.uz>

This is a MIME-encapsulated message.

--1AE531807E4B79.1574687746/post.mfa.uz
Content-Description: Notification
Content-Type: text/plain; charset=us-ascii

This is the mail system at host post.mfa.uz.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<cajsamattlin@live.se>: host eur.olc.protection.outlook.com[104.47.4.33] said:
    550 5.5.0 Requested action not taken: mailbox unavailable. (in reply to
    RCPT TO command)

--1AE531807E4B79.1574687746/post.mfa.uz
Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns; post.mfa.uz
X-Postfix-Queue-ID: 1AE531807E4B79
X-Postfix-Sender: rfc822; sco@mfa.uz
Arrival-Date: Mon, 25 Nov 2019 18:15:45 +0500 (+05)

Final-Recipient: rfc822; cajsamattlin@live.se
Original-Recipient: rfc822;cajsamattlin@live.se
Action: failed
Status: 5.5.0
Remote-MTA: dns; eur.olc.protection.outlook.com
Diagnostic-Code: smtp; 550 5.5.0 Requested action not taken: mailbox
    unavailable.

--1AE531807E4B79.1574687746/post.mfa.uz
Content-Description: Undelivered Message
Content-Type: message/rfc822

Return-Path: <sco@mfa.uz>
Received: from localhost (localhost [127.0.0.1])
   by post.mfa.uz (Postfix) with ESMTP id 1AE531807E4B79
   for <cajsamattlin@live.se>; Mon, 25 Nov 2019 18:15:45 +0500 (+05)
Received: from post.mfa.uz ([127.0.0.1])
   by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10032)
   with ESMTP id 5EQQUxrpIShM for <cajsamattlin@live.se>;
   Mon, 25 Nov 2019 18:15:44 +0500 (+05)
Received: from localhost (localhost [127.0.0.1])
   by post.mfa.uz (Postfix) with ESMTP id 8748418083E593
   for <cajsamattlin@live.se>; Mon, 25 Nov 2019 18:15:44 +0500 (+05)
DKIM-Filter: OpenDKIM Filter v2.10.3 post.mfa.uz 8748418083E593
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mfa.uz;
   s=9B56E9CC-C7EF-11E9-8457-543D24A30CEF; t=1574687744;
   bh=Xn/DThwHAy4QSiEEFpDZiwPseyn4eWirSfV/fd6ybJg=;
   h=Date:From:To:Message-ID:MIME-Version;
   b=c699G23UqwfTA4WC8ISacN1wjgL1Ck55KwqIrG2MSiWk+6iPXCiWyupDeJZzYNZwK
    8Zj4ffXaz4ctL0+jwFIaEdN6fsuaE6mv9ON1LyDT3p2Tvu98xcgwNE0tiD7tI4VFtr
    pF3pDQKlKLf8JEXi5UzrsVP8+rqxoOyGiQnt4tm0=
X-Virus-Scanned: amavisd-new at
Received: from post.mfa.uz ([127.0.0.1])
   by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10026)
   with ESMTP id PeRt5TWM24CY for <cajsamattlin@live.se>;
   Mon, 25 Nov 2019 18:15:44 +0500 (+05)
Received: from post.mfa.uz (unknown [187.109.166.197])
   by post.mfa.uz (Postfix) with ESMTPSA id 9707A18083E58E
   for <cajsamattlin@live.se>; Mon, 25 Nov 2019 18:15:43 +0500 (+05)
Date: Mon, 25 Nov 2019 14:14:11 +0100
From: "Robin Lindsten" <lefu@mfa.uz>
To: "cajsamattlin" <cajsamattlin@live.se>
Reply-To: "Robin Lindsten" <lefuv@live.se>
Message-ID: <4PTE7HMX90TXZN9P.aqec7f9u-6th3-mpt3-feqs-khhw52rvv6m6@mail.outlook.com>
Subject:
MIME-Version: 1.0
Content-Type: multipart/alternative;
   boundary="----=_Part_2464_189891274.7742914104566"
X-Mailer: Outlook for iOS and Android

------=_Part_2464_189891274.7742914104566
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

     


http://bit.do/fiimW







Robin Lindsten

------=_Part_2464_189891274.7742914104566
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">&nbsp; &nbsp; &nbsp; <br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">http://bit.do/fiimW <br><br><br><br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; "><br><br>Robin Lindsten
</div>
------=_Part_2464_189891274.7742914104566--


--1AE531807E4B79.1574687746/post.mfa.uz--








Received: from post.mfa.uz (LHLO post.mfa.uz) (172.30.30.179) by post.mfa.uz
 with LMTP; Mon, 25 Nov 2019 18:12:10 +0500 (UZT)
Received: from localhost (localhost [127.0.0.1])
   by post.mfa.uz (Postfix) with ESMTP id 6F2E21808280D1;
   Mon, 25 Nov 2019 18:12:10 +0500 (+05)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 1.428
X-Spam-Level: *
X-Spam-Status: No, score=1.428 required=6.6
   tests=[AXB_X_OUTLOOKPROT_ENVSDR=2.899, BAYES_00=-1.9, DKIM_SIGNED=0.1,
   DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_HTML_MOSTLY=0.428,
   SPF_HELO_PASS=-0.001, URIBL_BLOCKED=0.001]
   autolearn=no autolearn_force=no
Authentication-Results: post.mfa.uz (amavisd-new); dkim=pass (1024-bit key)
   header.d=svenskfilmindustri.onmicrosoft.com
Received: from post.mfa.uz ([127.0.0.1])
   by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10024)
   with ESMTP id u42GPbB9FzDZ; Mon, 25 Nov 2019 18:12:06 +0500 (+05)
Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-ve1eur04hn2093.outbound.protection.outlook.com [52.101.139.93])
   by post.mfa.uz (Postfix) with ESMTPS id 35463180798780
   for <sco@mfa.uz>; Mon, 25 Nov 2019 18:12:06 +0500 (+05)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=V480TWGpreGGbBHH31fxzO6uw6dluE+1WYRrKQ1du0Wtep14rXKL+uWoNY/IqNGmFptH+M6Mja8veEIpKCh2dot2PNF02pyxVMs0T/XpteNdEm3tCShmHOxBTUgarz3JhZzfZJa3ShaOhGvsoi8Ful2sfPAcwD5Jv/KXDF1ODrQsoAyy973gS3q7DVE5CSKpqb7W7p8udnSw/roxngeU8Rg3QPqzcS9qbenL0wQeAi896wc+xYec63TqYuUXVTXKRZUA0B18OZZFS74tESHLP20WkHkPj/9gIo7bIoOixHBGUytfkGEdjqG2tHCth5Z4Vzn6dtPFj4MO4rrfdmkNLQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=qMEwe4hdaxgZmMFBvobWnazej5hY/kOcyk7tX8jMr9A=;
 b=HQVASlkKRDglcro4i9GORO9tEgWGzyImXO5CjTFHUoKCm7+2NUuuSVy7yBg3Ct3PzcjJf+CVEwNR2ai1XUskS7Wj6dSFh2f0iY5LO9Qo+yrv3+UjZPIsYSMCXCKe9OO9jVYRVPH3fgtJtmm8qvWxLMz/PVCumFaHZ7UF6f4yw2ToJdHQsHF3T6BdaMuzrdvnL8Ndoz78V8fEDtxzZE6LFaGvccVFQVdLtzESMEmprcedRGeMKziLUKuVjkt5Qo+A9HEi3exq9T3rYQIYEUxHz5rnbm4X/lwj7X+0az1cWrR++aU6M91febzIUSxvtgMjE4xVrJz5JAexwbIujHHYCg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass; dmarc=pass
 action=none header.from=sfstudios.se; dkim=pass header.d=sfstudios.se;
 arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=svenskfilmindustri.onmicrosoft.com;
 s=selector2-svenskfilmindustri-onmicrosoft-com;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=qMEwe4hdaxgZmMFBvobWnazej5hY/kOcyk7tX8jMr9A=;
 b=xktVIftICSyNh6jvfOBAgJXjR1xG6LX5a5+YMo4jcvTlvJkobKOcAYHQiU8pY9oTZ9bE42UngfJFLmwt5h0whDKRRXrcKff/EaknDKyiS2RpyukvdHzgh3hGcEbe7nzvE3K6PZ/zijIpeWLUYmEVnianXh2Cu04pIM5Xf5M9VSw=
MIME-Version: 1.0
From: <postmaster@sfstudios.se>
To: <sco@mfa.uz>
Date: Mon, 25 Nov 2019 13:11:58 +0000
Content-Type: multipart/report; report-type=delivery-status;
   boundary="47229137-3dbd-47e6-8ebe-38ec5422f722"
X-MS-Exchange-Message-Is-Ndr:
Content-Language: en-US
Message-ID:
 <ddc48f2d-fcc8-47e8-bc03-81c9b8729071@AM0PR02MB5812.eurprd02.prod.outlook.com>
In-Reply-To: <B65BDEAC-8ED1-41A6-DFD2-7F10E99D432B@mfa.uz>
References: <B65BDEAC-8ED1-41A6-DFD2-7F10E99D432B@mfa.uz>
Subject: Undeliverable: hello
Auto-Submitted: auto-replied
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: AM0PR02MB5812:
X-MS-Exchange-PUrlCount: 4
X-Microsoft-Antispam-PRVS:
   <AM0PR02MB5812D55795D18BF0EEF055BEB84A0@AM0PR02MB5812.eurprd02.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:9508;
X-Forefront-PRVS: 0232B30BBC
X-Forefront-Antispam-Report:
   SFV:NSPM;SFS:(10019020)(50650200002)(136003)(396003)(346002)(366004)(376002)(39850400004)(189003)(199004)(1930700014)(14444005)(6916009)(52230400001)(74316002)(2876002)(5660300002)(10126004)(45080400002)(498600001)(78352004)(2351001)(76176011)(66574012)(316002)(19627235002)(81156014)(81166006)(8676002)(5320300001)(590304002)(31696002)(733005)(42186006)(16586007)(9686003)(6306002)(42882007)(6346003)(30864003)(1476002)(78496005)(11346002)(66946007)(606006)(66576008)(2906002)(446003)(236005)(1706002)(71190400001)(11286001)(82146005)(24704002)(579004);DIR:OUT;SFP:1501;SCL:1;SRVR:AM0PR02MB5812;H:;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:0;A:0;
Received-SPF: None (protection.outlook.com:  does not designate permitted
 sender hosts)
Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=<>;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
   3tPQDKiBKvQOm1FKH4SZ+26jGcTgUfoKaqA3PUZvaz2s/CrY2DLl0U67x6rpTfq+ZULx4eX1dujUHkzXF5n/K2lERDHXPU7Jb7r5uqpcmsOnwlbPlvPhpqNPKs72xbdFINWLI/pJSQ9qSxf668a3FRaaPyvmw7pHbEB59RNWKeOoH5RfGtBiqnlfAkIRjBFfl4y81x5ipUgm1Q7hm6jYkAya4n0rn+f6Moqyu5szi4MTN6q2hvbVm9dhQ6PVng8Ho/P9RN9vragkLt/1yErwTO0nxeNeNkKuhDstbMvdry9SIyAUyWq4uwrvqkU9m/UoRuQU6UhTKwv/AcMW3a44cJAnB4EHEzDhHP0yeWEsAIOhxJV5ZYn2bqLwUBKxjYtZHaC5GWLD4eGyAKQfA+fg3SlVVr6iy+8ckAOXbrQJr7WxzXnQOWXzFNkOEpQhtHT5Nf5WSfx/ztWb3LWBVHcvym8rxI2zisbjThHy1R+F1hH9C16Bp56KPxCsBabYcPk1oLz8oLAIfDYIN33rUh2oZKfbfcpTv9BnyYBf5Q7W3H8hCwTAR9wVtaBLwElFPl4a
X-OriginatorOrg: sfstudios.se
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Nov 2019 13:11:58.3677
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Network-Message-Id:
   4faf3ebc-8aca-4945-0d30-08d771a90d5b
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR02MB5812

--47229137-3dbd-47e6-8ebe-38ec5422f722
Content-Type: multipart/alternative; differences=Content-Type;
   boundary="b3c778e5-bb5d-4ddf-85e9-e932181f1f61"

--b3c778e5-bb5d-4ddf-85e9-e932181f1f61
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

[http://products.office.com/en-us/CMSImages/Office365Logo_Orange.png?versio=
n=3Db8d100a9-0a8b-8e6a-88e1-ef488fee0470]
Your message to nyhetsbrev@sf.se couldn't be delivered.
nyhetsbrev wasn't found at sf.se.
sco     Office 365      nyhetsbrev
Action Required                 Recipient
Unknown To address

How to Fix It
The address may be misspelled or may not exist. Try one or more of the foll=
owing:

  *   Send the message again following these steps: In Outlook, open this n=
on-delivery report (NDR) and choose Send Again from the Report ribbon. In O=
utlook on the web, select this NDR, then select the link "To send this mess=
age again, click here." Then delete and retype the entire recipient address=
. If prompted with an Auto-Complete List suggestion don't select it. After =
typing the complete address, click Send.
  *   Contact the recipient (by phone, for example) to check that the addre=
ss exists and is correct.
  *   The recipient may have set up email forwarding to an incorrect addres=
s. Ask them to check that any forwarding they've set up is working correctl=
y.
  *   Clear the recipient Auto-Complete List in Outlook or Outlook on the w=
eb by following the steps in this article: Fix email delivery issues for er=
ror code 5.1.10 in Office 365<https://go.microsoft.com/fwlink/?LinkId=3D532=
972>, and then send the message again. Retype the entire recipient address =
before selecting Send.

If the problem continues, forward this message to your email admin. If you'=
re an email admin, refer to the More Info for Email Admins section below.

Was this helpful? Send feedback to Microsoft<https://go.microsoft.com/fwlin=
k/?LinkId=3D525921>.
________________________________

More Info for Email Admins
Status code: 550 5.1.10

This error occurs because the sender sent a message to an email address hos=
ted by Office 365 but the address is incorrect or doesn't exist at the dest=
ination domain. The error is reported by the recipient domain's email serve=
r, but most often it must be fixed by the person who sent the message. If t=
he steps in the How to Fix It section above don't fix the problem, and you'=
re the email admin for the recipient, try one or more of the following:

The email address exists and is correct - Confirm that the recipient addres=
s exists, is correct, and is accepting messages.

Synchronize your directories - If you have a hybrid environment and are usi=
ng directory synchronization make sure the recipient's email address is syn=
ced correctly in both Office 365 and in your on-premises directory.

Errant forwarding rule - Check for forwarding rules that aren't behaving as=
 expected. Forwarding can be set up by an admin via mail flow rules or mail=
box forwarding address settings, or by the recipient via the Inbox Rules fe=
ature.

Recipient has a valid license - Make sure the recipient has an Office 365 l=
icense assigned to them. The recipient's email admin can use the Office 365=
 admin center to assign a license (Users > Active Users > select the recipi=
ent > Assigned License > Edit).

Mail flow settings and MX records are not correct - Misconfigured mail flow=
 or MX record settings can cause this error. Check your Office 365 mail flo=
w settings to make sure your domain and any mail flow connectors are set up=
 correctly. Also, work with your domain registrar to make sure the MX recor=
ds for your domain are configured correctly.

For more information and additional tips to fix this issue, see Fix email d=
elivery issues for error code 5.1.10 in Office 365<https://go.microsoft.com=
/fwlink/?LinkId=3D532972>.

Original Message Details
Created Date:   11/25/2019 1:10:22 PM
Sender Address: sco@mfa.uz
Recipient Address:      nyhetsbrev@sf.se
Subject:        hello

Error Details
Reported error: 550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient nyhets=
brev@sf.se not found by SMTP address lookup
DSN generated by:       AM0PR02MB5812.eurprd02.prod.outlook.com

Message Hops
HOP     TIME (UTC)      FROM    TO      WITH    RELAY TIME
1       11/25/2019
1:11:54 PM      post.mfa.uz     post.mfa.uz     ESMTPSA 1 min, 32 sec
2       11/25/2019
1:11:55 PM      post.mfa.uz     localhost       ESMTP   1 sec
3       11/25/2019
1:11:55 PM      localhost       post.mfa.uz     ESMTP   *
4       11/25/2019
1:11:55 PM      post.mfa.uz     localhost       ESMTP   *
5       11/25/2019
1:11:55 PM      localhost       post.mfa.uz     ESMTP   *
6       11/25/2019
1:11:57 PM      post.mfa.uz     VE1EUR03FT025.mail.protection.outlook.com  =
     Microsoft SMTP Server (version=3DTLS1_2, cipher=3DTLS_ECDHE_RSA_WITH_A=
ES_256_GCM_SHA384)    2 sec
7       11/25/2019
1:11:58 PM      VE1EUR03FT025.eop-EUR03.prod.protection.outlook.com     DB7=
PR02CA0006.outlook.office365.com     Microsoft SMTP Server (version=3DTLS1_=
2, cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)    1 sec
8       11/25/2019
1:11:58 PM      DB7PR02CA0006.eurprd02.prod.outlook.com AM0PR02MB5812.eurpr=
d02.prod.outlook.com Microsoft SMTP Server (version=3DTLS1_2, cipher=3DTLS_=
ECDHE_RSA_WITH_AES_256_GCM_SHA384)    *

Original Message Headers

Received: from DB7PR02CA0006.eurprd02.prod.outlook.com (2603:10a6:10:52::19=
)
 by AM0PR02MB5812.eurprd02.prod.outlook.com (2603:10a6:208:17f::22) with
 Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.19; Mon, 25 =
Nov
 2019 13:11:58 +0000
Received: from VE1EUR03FT025.eop-EUR03.prod.protection.outlook.com
 (2a01:111:f400:7e09::200) by DB7PR02CA0006.outlook.office365.com
 (2603:10a6:10:52::19) with Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.16 via Front=
end
 Transport; Mon, 25 Nov 2019 13:11:58 +0000
Authentication-Results: spf=3Dpass (sender IP is 195.158.27.138)
 smtp.mailfrom=3Dmfa.uz; sf.se; dkim=3Dpass (signature was verified)
 header.d=3Dmfa.uz;sf.se; dmarc=3Dpass action=3Dnone header.from=3Dmfa.uz;
Received-SPF: Pass (protection.outlook.com: domain of mfa.uz designates
 195.158.27.138 as permitted sender) receiver=3Dprotection.outlook.com;
 client-ip=3D195.158.27.138; helo=3Dpost.mfa.uz;
Received: from post.mfa.uz (195.158.27.138) by
 VE1EUR03FT025.mail.protection.outlook.com (10.152.18.74) with Microsoft SM=
TP
 Server (version=3DTLS1_2, cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) =
id
 15.20.2474.17 via Frontend Transport; Mon, 25 Nov 2019 13:11:57 +0000
Received: from localhost (localhost [127.0.0.1])
        by post.mfa.uz (Postfix) with ESMTP id DE88718054048C
        for <nyhetsbrev@sf.se>; Mon, 25 Nov 2019 18:11:55 +0500 (+05)
Received: from post.mfa.uz ([127.0.0.1])
        by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10032)
        with ESMTP id BSoyTS--TEU9 for <nyhetsbrev@sf.se>;
        Mon, 25 Nov 2019 18:11:55 +0500 (+05)
Received: from localhost (localhost [127.0.0.1])
        by post.mfa.uz (Postfix) with ESMTP id 5AD0F1808280D1
        for <nyhetsbrev@sf.se>; Mon, 25 Nov 2019 18:11:55 +0500 (+05)
DKIM-Filter: OpenDKIM Filter v2.10.3 post.mfa.uz 5AD0F1808280D1
DKIM-Signature: v=3D1; a=3Drsa-sha256; c=3Drelaxed/relaxed; d=3Dmfa.uz;
        s=3D9B56E9CC-C7EF-11E9-8457-543D24A30CEF; t=3D1574687515;
        bh=3D98NFh4TajdmVB/spHpmpegSVvggc/lLa/DBRvXxUNtg=3D;
        h=3DFrom:MIME-version:Date:Message-Id:To;
        b=3DtTul4omgiMPSsJSqiPr0BEcsuSuZ/5renNeO+KUspvGHe6YzNiV0FhnLqD52I+C=
XI
         9QFxl9/UbgeCMT6nvEXWEpqf5mhZ4+b1swWhIcHE24ccUV12whhV16vDRbhVN9yTXi
         OIX0eyyzi3Zn6lUfyOf34ipnWru1CRzeUP7YBU74=3D
X-Virus-Scanned: amavisd-new at
Received: from post.mfa.uz ([127.0.0.1])
        by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10026)
        with ESMTP id eqp4n9srIoPZ for <nyhetsbrev@sf.se>;
        Mon, 25 Nov 2019 18:11:55 +0500 (+05)
Received: from post.mfa.uz (unknown [61.6.247.92])
        by post.mfa.uz (Postfix) with ESMTPSA id 6071E18054048C
        for <nyhetsbrev@sf.se>; Mon, 25 Nov 2019 18:11:54 +0500 (+05)
Content-Transfer-Encoding: 7bit
From: "=3D?UTF-8?B?bGlsbGFfbWFuZ2E5NA=3D=3D?=3D" <lilla_manga94@mfa.uz>
Content-Type: text/plain; charset=3Dus-ascii
MIME-Version: 1.0 (1.0)
Date: Mon, 25 Nov 2019 14:10:22 +0100
Message-ID: <B65BDEAC-8ED1-41A6-DFD2-7F10E99D432B@mfa.uz>
Subject: hello
To: "nyhetsbrev" <nyhetsbrev@sf.se>
Reply-To: "=3D?UTF-8?B?bGlsbGFfbWFuZ2E5NA=3D=3D?=3D" <lilla_manga94r@msn.co=
m>
X-Mailer: iPhone Mail (15B150)
Return-Path: sco@mfa.uz
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 8e76ef3c-4dbc-41ce-b75d-23946e02f2a9:0
X-Forefront-Antispam-Report: CIP:195.158.27.138;IPV:NLI;CTRY:UZ;EFV:NLI;
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: d3f3f125-1b26-4933-8127-08d771a90c=
e7
X-MS-TrafficTypeDiagnostic: AM0PR02MB5812:
X-MS-Exchange-PUrlCount: 1


--b3c778e5-bb5d-4ddf-85e9-e932181f1f61
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>
  <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D=
1" />
  <head>
    <title>
          DSN
        </title>
  </head>
  <body style=3D"        background-color: white;      ">
    <table style=3D"        background-color: white;         max-width: 548=
px;         color: black;         border-spacing: 0px 0px;         padding-=
top: 0px;         padding-bottom: 0px;        border-collapse: collapse;   =
   " width=3D"548" cellspacing=3D"0" cellpadding=3D"0">
      <tbody>
        <tr>
          <td style=3D"        text-align: left;        padding-bottom: 20p=
x;      ">
            <img height=3D"28" width=3D"126" style=3D"        max-width: 10=
0%;      " src=3D"http://products.office.com/en-us/CMSImages/Office365Logo_=
Orange.png?version=3Db8d100a9-0a8b-8e6a-88e1-ef488fee0470" />
          </td>
        </tr>
        <tr>
          <td style=3D"        font-family: 'Segoe UI', Frutiger, Arial, sa=
ns-serif;        font-size: 16px;         padding-bottom: 10px;         -ms=
-text-size-adjust: 100%;        text-align: left;      ">Your message to <s=
pan style=3D"        color: #0072c6;      ">nyhetsbrev@sf.se</span> couldn'=
t be delivered.<br /></td>
        </tr>
        <tr>
          <td style=3D"        font-family: 'Segoe UI', Frutiger, Arial, sa=
ns-serif;         font-size: 24px;         padding-top: 0px;         paddin=
g-bottom: 20px;         text-align: center;         -ms-text-size-adjust: 1=
00%;      ">
            <span style=3D"        color: #0072c6;      ">nyhetsbrev</span>=
 wasn't found at <span style=3D"        color: #0072c6;      ">sf.se</span>=
.<br /></td>
        </tr>
        <tr>
          <td style=3D"        padding-bottom: 15px;         padding-left: =
0px;         padding-right: 0px;         border-spacing: 0px 0px;      ">
            <table style=3D"        max-width: 548px;         font-weight: =
600;        border-spacing: 0px 0px;         padding-top: 0px;         padd=
ing-bottom: 0px;        border-collapse: collapse;      ">
              <tbody>
                <tr>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        font-size: 15px;        font-weight: 600;        t=
ext-align: left;        width: 181px;        -ms-text-size-adjust: 100%;   =
     vertical-align: bottom;      ">
                    <font color=3D"#ffffff">
                      <span style=3D"color:#000000">sco</span>
                    </font>
                  </td>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        font-size: 15px;        font-weight: 600;        t=
ext-align: center;        width: 186px;        -ms-text-size-adjust: 100%; =
       vertical-align: bottom;      ">
                    <font color=3D"#ffffff">
                      <span style=3D"color:#000000">Office 365</span>
                    </font>
                  </td>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;         -ms-text-size-adjust: 100%;         font-size: 15=
px;         font-weight: 600;        text-align: right;         width: 181p=
x;         vertical-align: bottom;      ">
                    <font color=3D"#ffffff">
                      <span style=3D"color:#000000">nyhetsbrev</span>
                    </font>
                  </td>
                </tr>
                <tr>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        font-weight: 400;        text-align: left;        padding-top: 0px=
;        padding-bottom: 0px;        vertical-align: middle;        width: =
181px;      ">
                    <font color=3D"#ffffff">
                      <span style=3D"        color: #c00000;      ">
                        <b>Action Required</b>
                      </span>
                    </font>
                  </td>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        font-weight: 400;        text-align: center;        padding-top: 0=
px;        padding-bottom: 0px;        vertical-align: middle;        width=
: 186px;      " />
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        font-weight: 400;        text-align: right;        padding-top: 0p=
x;        padding-bottom: 0px;        vertical-align: middle;        width:=
 181px;      ">
                    <font color=3D"#ffffff">
                      <span style=3D"color:#000000">Recipient</span>
                    </font>
                  </td>
                </tr>
                <tr>
                  <td colspan=3D"3" style=3D"        padding-top:0;        =
padding-bottom:0;        padding-left:0;        padding-right:0      ">
                    <table cellspacing=3D"0" cellpadding=3D"0" style=3D"   =
     border-spacing: 0px 0px;        padding-top: 0px;        padding-botto=
m: 0px;        padding-left: 0px;        padding-right: 0px;        border-=
collapse: collapse;      ">
                      <tbody>
                        <tr height=3D"10">
                          <td width=3D"180" height=3D"10" bgcolor=3D"#c0000=
0" style=3D"        width: 180px;        line-height: 10px;        height: =
10px;        font-size: 6px;        padding-top: 0;        padding-bottom: =
0;        padding-left: 0;        padding-right: 0;      "><!--[if gte mso =
15]>&nbsp;<![endif]--></td>
                          <td width=3D"4" height=3D"10" bgcolor=3D"#ffffff"=
 style=3D"        width: 4px;        line-height: 10px;        height: 10px=
;        font-size: 6px;        padding-top: 0;        padding-bottom: 0;  =
      padding-left: 0;        padding-right: 0;      "><!--[if gte mso 15]>=
&nbsp;<![endif]--></td>
                          <td width=3D"180" height=3D"10" bgcolor=3D"#ccccc=
c" style=3D"        width: 180px;        line-height: 10px;        height: =
10px;        font-size: 6px;        padding-top: 0;        padding-bottom: =
0;        padding-left: 0;        padding-right: 0;      "><!--[if gte mso =
15]>&nbsp;<![endif]--></td>
                          <td width=3D"4" height=3D"10" bgcolor=3D"#ffffff"=
 style=3D"        width: 4px;        line-height: 10px;        height: 10px=
;        font-size: 6px;        padding-top: 0;        padding-bottom: 0;  =
      padding-left: 0;        padding-right: 0;      "><!--[if gte mso 15]>=
&nbsp;<![endif]--></td>
                          <td width=3D"180" height=3D"10" bgcolor=3D"#ccccc=
c" style=3D"        width: 180px;        line-height: 10px;        height: =
10px;        font-size: 6px;        padding-top: 0;        padding-bottom: =
0;        padding-left: 0;        padding-right: 0;      "><!--[if gte mso =
15]>&nbsp;<![endif]--></td>
                        </tr>
                      </tbody>
                    </table>
                  </td>
                </tr>
                <tr>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        text-align: left;        width: 181px;        line-height: 20px;  =
      font-weight: 400;        padding-top: 0px;        padding-left: 0px; =
       padding-right: 0px;        padding-bottom: 0px;      ">
                    <font color=3D"#ffffff">
                      <span style=3D"        color: #c00000;      ">Unknown=
 To address</span>
                    </font>
                  </td>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        text-align: center;        width: 186px;        line-height: 20px;=
        font-weight: 400;        padding-top: 0px;        padding-left: 0px=
;        padding-right: 0px;        padding-bottom: 0px;      " />
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        text-align: right;        width: 181px;        line-height: 20px; =
       font-weight: 400;        padding-top: 0px;        padding-left: 0px;=
        padding-right: 0px;        padding-bottom: 0px;      " />
                </tr>
              </tbody>
            </table>
          </td>
        </tr>
        <tr>
          <td style=3D"        width: 100%;        padding-top: 0px;       =
 padding-right: 10px;        padding-left: 10px;      ">
            <br />
            <table style=3D"        width: 100%;        padding-right: 0px;=
        padding-left: 0px;        padding-top: 0px;        padding-bottom: =
0px;        background-color: #f2f5fa;        margin-left: 0px;      ">
              <tbody>
                <tr>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 21px=
;        font-weight: 500;        background-color: #f2f5fa;        padding=
-top: 0px;        padding-bottom: 0px;        padding-left: 10px;        pa=
dding-right: 10px;      ">How to Fix It</td>
                </tr>
                <tr>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 16px=
;        font-weight: 400;        padding-top: 0px;        padding-bottom: =
6px;        padding-left: 10px;        padding-right: 10px;        backgrou=
nd-color: #f2f5fa;      ">The address may be misspelled or may not exist. T=
ry one or more of the following:</td>
                </tr>
                <tr>
                  <td style=3D"         padding-top: 0px;         padding-b=
ottom: 0px;         padding-left: 0px;         padding-right: 0px;        b=
order-spacing: 0px 0px;      ">
                    <ul style=3D"        font-family: 'Segoe UI', Frutiger,=
 Arial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 16=
px;        font-weight: 400;        margin-left: 40px;        margin-bottom=
: 5px;        background-color: #f2f5fa;        padding-top: 0px;        pa=
dding-bottom: 0px;        padding-left: 6px;        padding-right: 6px;    =
  ">
                      <li>Send the message again following these steps: In =
Outlook, open this non-delivery report (NDR) and choose <b>Send Again</b> f=
rom the Report ribbon. In Outlook on the web, select this NDR, then select =
the link "<b>To send this message again, click here.</b>" Then delete and r=
etype the entire recipient address. If prompted with an Auto-Complete List =
suggestion don't select it. After typing the complete address, click <b>Sen=
d</b>.</li>
                      <li>Contact the recipient (by phone, for example) to =
check that the address exists and is correct.</li>
                      <li>The recipient may have set up email forwarding to=
 an incorrect address. Ask them to check that any forwarding they've set up=
 is working correctly.</li>
                      <li>Clear the recipient Auto-Complete List in Outlook=
 or Outlook on the web by following the steps in this article: <a href=3D"h=
ttps://go.microsoft.com/fwlink/?LinkId=3D532972">Fix email delivery issues =
for error code 5.1.10 in Office 365</a>, and then send the message again. R=
etype the entire recipient address before selecting <b>Send</b>.</li>
                    </ul>
                  </td>
                </tr>
                <tr>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 16px=
;        font-weight: 400;        padding-top: 0px;        padding-bottom: =
6px;        padding-left: 10px;        padding-right: 10px;        backgrou=
nd-color: #f2f5fa;      ">If the problem continues, forward this message to=
 your email admin. If you're an email admin, refer to the <b>More Info for =
Email Admins</b> section below.</td>
                </tr>
              </tbody>
            </table>
          </td>
        </tr>
        <tr>
          <td style=3D"        font-family: 'Segoe UI', Frutiger, Arial, sa=
ns-serif;        -ms-text-size-adjust: 100%;        font-size: 14px;       =
 font-weight: 400;        padding-top: 10px;        padding-bottom: 0px;   =
     padding-bottom: 4px;      ">
            <br />
            <em>Was this helpful? <a href=3D"https://go.microsoft.com/fwlin=
k/?LinkId=3D525921">Send feedback to Microsoft</a>.</em>
          </td>
        </tr>
        <tr>
          <td style=3D"        -ms-text-size-adjust: 100%;        font-size=
: 0px;        line-height: 0px;        padding-top: 0px;        padding-bot=
tom: 0px;      ">
            <hr />
          </td>
        </tr>
        <tr>
          <td style=3D"        font-family: 'Segoe UI', Frutiger, Arial, sa=
ns-serif;        -ms-text-size-adjust: 100%;        font-size: 21px;       =
 font-weight: 500;      ">
            <br />More Info for Email Admins</td>
        </tr>
        <tr>
          <td style=3D"        font-family: 'Segoe UI', Frutiger, Arial, sa=
ns-serif;        -ms-text-size-adjust: 100%;        font-size: 14px;      "=
>
            <em>Status code: 550 5.1.10</em>
            <br />
            <br />This error occurs because the sender sent a message to an=
 email address hosted by Office 365 but the address is incorrect or doesn't=
 exist at the destination domain. The error is reported by the recipient do=
main's email server, but most often it must be fixed by the person who sent=
 the message. If the steps in the <b>How to Fix It</b> section above don't =
fix the problem, and you're the email admin for the recipient, try one or m=
ore of the following:<br /><br /><b>The email address exists and is correct=
</b> - Confirm that the recipient address exists, is correct, and is accept=
ing messages.<br /><br /><b>Synchronize your directories</b> - If you have =
a hybrid environment and are using directory synchronization make sure the =
recipient's email address is synced correctly in both Office 365 and in you=
r on-premises directory.<br /><br /><b>Errant forwarding rule</b> - Check f=
or forwarding rules that aren't behaving as expected. Forwarding can be set=
 up by an admin via mail flow rules or mailbox forwarding address settings,=
 or by the recipient via the Inbox Rules feature.<br /><br /><b>Recipient h=
as a valid license</b> - Make sure the recipient has an Office 365 license =
assigned to them. The recipient's email admin can use the Office 365 admin =
center to assign a license (Users &gt; Active Users &gt; select the recipie=
nt &gt; Assigned License &gt; Edit).<br /><br /><b>Mail flow settings and M=
X records are not correct</b> - Misconfigured mail flow or MX record settin=
gs can cause this error. Check your Office 365 mail flow settings to make s=
ure your domain and any mail flow connectors are set up correctly. Also, wo=
rk with your domain registrar to make sure the MX records for your domain a=
re configured correctly.<br /><br />For more information and additional tip=
s to fix this issue, see <a href=3D"https://go.microsoft.com/fwlink/?LinkId=
=3D532972">Fix email delivery issues for error code 5.1.10 in Office 365</a=
>.<br /><br /></td>
        </tr>
        <tr>
          <td style=3D"        font-family: 'Segoe UI', Frutiger, Arial, sa=
ns-serif;        -ms-text-size-adjust: 100%;        font-size: 17px;       =
 font-weight: 500;      ">Original Message Details</td>
        </tr>
        <tr>
          <td style=3D"        font-size: 14px;        line-height: 20px;  =
      font-family: 'Segoe UI', Frutiger, Arial, sans-serif;        -ms-text=
-size-adjust: 100%;        font-weight: 500;      ">
            <table style=3D"        width: 100%;        border-collapse: co=
llapse;        margin-left: 10px;      ">
              <tbody>
                <tr>
                  <td valign=3D"top" style=3D"        font-family: 'Segoe U=
I', Frutiger, Arial, sans-serif;        font-size: 14px;        -ms-text-si=
ze-adjust: 100%;        white-space: nowrap;        font-weight: 500;      =
  width: 140px;      ">Created Date:</td>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        font-weight: 400;      ">11/25/2019 1:10:22 PM</td>
                </tr>
                <tr>
                  <td valign=3D"top" style=3D"        font-family: 'Segoe U=
I', Frutiger, Arial, sans-serif;        font-size: 14px;        -ms-text-si=
ze-adjust: 100%;        white-space: nowrap;        font-weight: 500;      =
  width: 140px;      ">Sender Address:</td>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        font-weight: 400;      ">sco@mfa.uz</td>
                </tr>
                <tr>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        font-size: 14px;        -ms-text-size-adjust: 100%=
;        white-space: nowrap;        font-weight: 500;        width: 140px;=
      ">Recipient Address:</td>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        font-weight: 400;      ">nyhetsbrev@sf.se</td>
                </tr>
                <tr>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        font-size: 14px;        -ms-text-size-adjust: 100%=
;        white-space: nowrap;        font-weight: 500;        width: 140px;=
      ">Subject:</td>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        font-weight: 400;      ">hello</td>
                </tr>
              </tbody>
            </table>
          </td>
        </tr>
        <tr>
          <td style=3D"        font-family: 'Segoe UI', Frutiger, Arial, sa=
ns-serif;        -ms-text-size-adjust: 100%;        font-size: 17px;       =
 font-weight: 500;      ">
            <br />Error Details</td>
        </tr>
        <tr>
          <td style=3D"        font-size: 14px;        line-height: 20px;  =
      font-family: 'Segoe UI', Frutiger, Arial, sans-serif;        -ms-text=
-size-adjust: 100%;        font-weight: 500;      ">
            <table style=3D"        width: 100%;        border-collapse: co=
llapse;        margin-left: 10px;      ">
              <tbody>
                <tr>
                  <td valign=3D"top" style=3D"        font-family: 'Segoe U=
I', Frutiger, Arial, sans-serif;        font-size: 14px;        -ms-text-si=
ze-adjust: 100%;        white-space: nowrap;        font-weight: 500;      =
  width: 140px;      ">Reported error:</td>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        font-weight: 400;      ">
                    <em>550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipien=
t nyhetsbrev@sf.se not found by SMTP address lookup</em>
                  </td>
                </tr>
                <tr>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        font-size: 14px;        -ms-text-size-adjust: 100%=
;        white-space: nowrap;        font-weight: 500;        width: 140px;=
      ">DSN generated by:</td>
                  <td style=3D"        font-family: 'Segoe UI', Frutiger, A=
rial, sans-serif;        -ms-text-size-adjust: 100%;        font-size: 14px=
;        font-weight: 400;      ">AM0PR02MB5812.eurprd02.prod.outlook.com</=
td>
                </tr>
              </tbody>
            </table>
          </td>
        </tr>
      </tbody>
    </table>
    <br />
    <table style=3D"width: 880px;" cellspacing=3D"0">
      <tr>
        <td colspan=3D"6" style=3D"        padding-top: 4px;        border-=
bottom: 1px solid #999999;        padding-bottom: 4px;        line-height: =
120%;        font-size: 17px;        font-family: 'Segoe UI', Frutiger, Ari=
al, sans-serif;        -ms-text-size-adjust: 100%;        font-weight: 500;=
      ">Message Hops</td>
      </tr>
      <tr>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        background-color: #f2f5fa;        border-bottom: 1p=
x solid #999999;        white-space: nowrap;        padding: 8px;      ">HO=
P</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        background-color: #f2f5fa;        border-bottom: 1p=
x solid #999999;        white-space: nowrap;        padding: 8px;        wi=
dth: 80px;      ">TIME (UTC)</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        background-color: #f2f5fa;        border-bottom: 1p=
x solid #999999;        white-space: nowrap;        padding: 8px;      ">FR=
OM</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        background-color: #f2f5fa;        border-bottom: 1p=
x solid #999999;        white-space: nowrap;        padding: 8px;      ">TO=
</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        background-color: #f2f5fa;        border-bottom: 1p=
x solid #999999;        white-space: nowrap;        padding: 8px;      ">WI=
TH</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        background-color: #f2f5fa;        border-bottom: 1p=
x solid #999999;        white-space: nowrap;        padding: 8px;      ">RE=
LAY TIME</td>
      </tr>
      <tr>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: center;      ">1</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;        width: 80px;      ">11/25/2019<br />1:1=
1:54 PM</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">post.mfa.uz</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">post.mfa.uz</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">ESMTPSA</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">1&nbsp;min, 32&nbsp;sec</td>
      </tr>
      <tr>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: center;      ">2</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;        width: 80px;      ">11/25/2019<br />1:1=
1:55 PM</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">post.mfa.uz</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">localhost</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">ESMTP</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">1&nbsp;sec</td>
      </tr>
      <tr>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: center;      ">3</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;        width: 80px;      ">11/25/2019<br />1:1=
1:55 PM</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">localhost</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">post.mfa.uz</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">ESMTP</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">*</td>
      </tr>
      <tr>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: center;      ">4</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;        width: 80px;      ">11/25/2019<br />1:1=
1:55 PM</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">post.mfa.uz</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">localhost</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">ESMTP</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">*</td>
      </tr>
      <tr>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: center;      ">5</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;        width: 80px;      ">11/25/2019<br />1:1=
1:55 PM</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">localhost</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">post.mfa.uz</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">ESMTP</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">*</td>
      </tr>
      <tr>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: center;      ">6</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;        width: 80px;      ">11/25/2019<br />1:1=
1:57 PM</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">post.mfa.uz</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">VE1EUR03FT025.mail.protection.outlook.c=
om</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">Microsoft SMTP Server (version=3DTLS1_2=
, cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">2&nbsp;sec</td>
      </tr>
      <tr>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: center;      ">7</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;        width: 80px;      ">11/25/2019<br />1:1=
1:58 PM</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">VE1EUR03FT025.eop-EUR03.prod.protection=
.outlook.com</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">DB7PR02CA0006.outlook.office365.com</td=
>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">Microsoft SMTP Server (version=3DTLS1_2=
, cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">1&nbsp;sec</td>
      </tr>
      <tr>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: center;      ">8</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;        width: 80px;      ">11/25/2019<br />1:1=
1:58 PM</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">DB7PR02CA0006.eurprd02.prod.outlook.com=
</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">AM0PR02MB5812.eurprd02.prod.outlook.com=
</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">Microsoft SMTP Server (version=3DTLS1_2=
, cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)</td>
        <td style=3D"        font-size: 12px;        font-family: 'Segoe UI=
', Frutiger, Arial, sans-serif;        -ms-text-size-adjust: 100%;        f=
ont-weight: 500;        border-bottom: 1px solid #999999;        padding: 8=
px;        text-align: left;      ">*</td>
      </tr>
    </table>
    <p style=3D"        font-family: 'Segoe UI', Frutiger, Arial, sans-seri=
f;        -ms-text-size-adjust: 100%;        font-size: 17px;        font-w=
eight: 500;        padding-top: 4px;        padding-bottom: 0;        margi=
n-top: 19px;        margin-bottom: 5px;      ">Original Message Headers</p>
    <pre style=3D"        color: gray;        white-space: pre;        padd=
ing-top: 0;        margin-top: 5px;      ">Received: from DB7PR02CA0006.eur=
prd02.prod.outlook.com (2603:10a6:10:52::19)
 by AM0PR02MB5812.eurprd02.prod.outlook.com (2603:10a6:208:17f::22) with
 Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.19; Mon, 25 =
Nov
 2019 13:11:58 +0000
Received: from VE1EUR03FT025.eop-EUR03.prod.protection.outlook.com
 (2a01:111:f400:7e09::200) by DB7PR02CA0006.outlook.office365.com
 (2603:10a6:10:52::19) with Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.16 via Front=
end
 Transport; Mon, 25 Nov 2019 13:11:58 +0000
Authentication-Results: spf=3Dpass (sender IP is 195.158.27.138)
 smtp.mailfrom=3Dmfa.uz; sf.se; dkim=3Dpass (signature was verified)
 header.d=3Dmfa.uz;sf.se; dmarc=3Dpass action=3Dnone header.from=3Dmfa.uz;
Received-SPF: Pass (protection.outlook.com: domain of mfa.uz designates
 195.158.27.138 as permitted sender) receiver=3Dprotection.outlook.com;
 client-ip=3D195.158.27.138; helo=3Dpost.mfa.uz;
Received: from post.mfa.uz (195.158.27.138) by
 VE1EUR03FT025.mail.protection.outlook.com (10.152.18.74) with Microsoft SM=
TP
 Server (version=3DTLS1_2, cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) =
id
 15.20.2474.17 via Frontend Transport; Mon, 25 Nov 2019 13:11:57 +0000
Received: from localhost (localhost [127.0.0.1])
   by post.mfa.uz (Postfix) with ESMTP id DE88718054048C
   for &lt;nyhetsbrev@sf.se&gt;; Mon, 25 Nov 2019 18:11:55 +0500 (+05)
Received: from post.mfa.uz ([127.0.0.1])
   by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10032)
   with ESMTP id BSoyTS--TEU9 for &lt;nyhetsbrev@sf.se&gt;;
   Mon, 25 Nov 2019 18:11:55 +0500 (+05)
Received: from localhost (localhost [127.0.0.1])
   by post.mfa.uz (Postfix) with ESMTP id 5AD0F1808280D1
   for &lt;nyhetsbrev@sf.se&gt;; Mon, 25 Nov 2019 18:11:55 +0500 (+05)
DKIM-Filter: OpenDKIM Filter v2.10.3 post.mfa.uz 5AD0F1808280D1
DKIM-Signature: v=3D1; a=3Drsa-sha256; c=3Drelaxed/relaxed; d=3Dmfa.uz;
   s=3D9B56E9CC-C7EF-11E9-8457-543D24A30CEF; t=3D1574687515;
   bh=3D98NFh4TajdmVB/spHpmpegSVvggc/lLa/DBRvXxUNtg=3D;
   h=3DFrom:MIME-version:Date:Message-Id:To;
   b=3DtTul4omgiMPSsJSqiPr0BEcsuSuZ/5renNeO+KUspvGHe6YzNiV0FhnLqD52I+CXI
    9QFxl9/UbgeCMT6nvEXWEpqf5mhZ4+b1swWhIcHE24ccUV12whhV16vDRbhVN9yTXi
    OIX0eyyzi3Zn6lUfyOf34ipnWru1CRzeUP7YBU74=3D
X-Virus-Scanned: amavisd-new at=20
Received: from post.mfa.uz ([127.0.0.1])
   by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10026)
   with ESMTP id eqp4n9srIoPZ for &lt;nyhetsbrev@sf.se&gt;;
   Mon, 25 Nov 2019 18:11:55 +0500 (+05)
Received: from post.mfa.uz (unknown [61.6.247.92])
   by post.mfa.uz (Postfix) with ESMTPSA id 6071E18054048C
   for &lt;nyhetsbrev@sf.se&gt;; Mon, 25 Nov 2019 18:11:54 +0500 (+05)
Content-Transfer-Encoding: 7bit
From: "=3D?UTF-8?B?bGlsbGFfbWFuZ2E5NA=3D=3D?=3D" &lt;lilla_manga94@mfa.uz&g=
t;
Content-Type: text/plain; charset=3Dus-ascii
MIME-Version: 1.0 (1.0)
Date: Mon, 25 Nov 2019 14:10:22 +0100
Message-ID: &lt;B65BDEAC-8ED1-41A6-DFD2-7F10E99D432B@mfa.uz&gt;
Subject: hello
To: "nyhetsbrev" &lt;nyhetsbrev@sf.se&gt;
Reply-To: "=3D?UTF-8?B?bGlsbGFfbWFuZ2E5NA=3D=3D?=3D" &lt;lilla_manga94r@msn=
.com&gt;
X-Mailer: iPhone Mail (15B150)
Return-Path: sco@mfa.uz
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 8e76ef3c-4dbc-41ce-b75d-23946e02f2a9:0
X-Forefront-Antispam-Report: CIP:195.158.27.138;IPV:NLI;CTRY:UZ;EFV:NLI;
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: d3f3f125-1b26-4933-8127-08d771a90c=
e7
X-MS-TrafficTypeDiagnostic: AM0PR02MB5812:
X-MS-Exchange-PUrlCount: 1
</pre>
  </body>
</html>=

--b3c778e5-bb5d-4ddf-85e9-e932181f1f61--

--47229137-3dbd-47e6-8ebe-38ec5422f722
Content-Type: message/delivery-status

Reporting-MTA: dns;AM0PR02MB5812.eurprd02.prod.outlook.com
Received-From-MTA: dns;post.mfa.uz
Arrival-Date: Mon, 25 Nov 2019 13:11:58 +0000

Original-Recipient: rfc822;nyhetsbrev@sf.se
Final-Recipient: rfc822;nyhetsbrev@sf.se
Action: failed
Status: 5.1.10
Diagnostic-Code: smtp;550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient nyhetsbrev@sf.se not found by SMTP address lookup
X-Display-Name: nyhetsbrev


--47229137-3dbd-47e6-8ebe-38ec5422f722
Content-Type: message/rfc822

Received: from DB7PR02CA0006.eurprd02.prod.outlook.com (2603:10a6:10:52::19)
 by AM0PR02MB5812.eurprd02.prod.outlook.com (2603:10a6:208:17f::22) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.19; Mon, 25 Nov
 2019 13:11:58 +0000
Received: from VE1EUR03FT025.eop-EUR03.prod.protection.outlook.com
 (2a01:111:f400:7e09::200) by DB7PR02CA0006.outlook.office365.com
 (2603:10a6:10:52::19) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.16 via Frontend
 Transport; Mon, 25 Nov 2019 13:11:58 +0000
Authentication-Results: spf=pass (sender IP is 195.158.27.138)
 smtp.mailfrom=mfa.uz; sf.se; dkim=pass (signature was verified)
 header.d=mfa.uz;sf.se; dmarc=pass action=none header.from=mfa.uz;
Received-SPF: Pass (protection.outlook.com: domain of mfa.uz designates
 195.158.27.138 as permitted sender) receiver=protection.outlook.com;
 client-ip=195.158.27.138; helo=post.mfa.uz;
Received: from post.mfa.uz (195.158.27.138) by
 VE1EUR03FT025.mail.protection.outlook.com (10.152.18.74) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.2474.17 via Frontend Transport; Mon, 25 Nov 2019 13:11:57 +0000
Received: from localhost (localhost [127.0.0.1])
   by post.mfa.uz (Postfix) with ESMTP id DE88718054048C
   for <nyhetsbrev@sf.se>; Mon, 25 Nov 2019 18:11:55 +0500 (+05)
Received: from post.mfa.uz ([127.0.0.1])
   by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10032)
   with ESMTP id BSoyTS--TEU9 for <nyhetsbrev@sf.se>;
   Mon, 25 Nov 2019 18:11:55 +0500 (+05)
Received: from localhost (localhost [127.0.0.1])
   by post.mfa.uz (Postfix) with ESMTP id 5AD0F1808280D1
   for <nyhetsbrev@sf.se>; Mon, 25 Nov 2019 18:11:55 +0500 (+05)
DKIM-Filter: OpenDKIM Filter v2.10.3 post.mfa.uz 5AD0F1808280D1
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mfa.uz;
   s=9B56E9CC-C7EF-11E9-8457-543D24A30CEF; t=1574687515;
   bh=98NFh4TajdmVB/spHpmpegSVvggc/lLa/DBRvXxUNtg=;
   h=From:MIME-version:Date:Message-Id:To;
   b=tTul4omgiMPSsJSqiPr0BEcsuSuZ/5renNeO+KUspvGHe6YzNiV0FhnLqD52I+CXI
    9QFxl9/UbgeCMT6nvEXWEpqf5mhZ4+b1swWhIcHE24ccUV12whhV16vDRbhVN9yTXi
    OIX0eyyzi3Zn6lUfyOf34ipnWru1CRzeUP7YBU74=
X-Virus-Scanned: amavisd-new at
Received: from post.mfa.uz ([127.0.0.1])
   by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10026)
   with ESMTP id eqp4n9srIoPZ for <nyhetsbrev@sf.se>;
   Mon, 25 Nov 2019 18:11:55 +0500 (+05)
Received: from post.mfa.uz (unknown [61.6.247.92])
   by post.mfa.uz (Postfix) with ESMTPSA id 6071E18054048C
   for <nyhetsbrev@sf.se>; Mon, 25 Nov 2019 18:11:54 +0500 (+05)
Content-Transfer-Encoding: 7bit
From: "=?UTF-8?B?bGlsbGFfbWFuZ2E5NA==?=" <lilla_manga94@mfa.uz>
Content-Type: text/plain; charset=us-ascii
MIME-Version: 1.0 (1.0)
Date: Mon, 25 Nov 2019 14:10:22 +0100
Message-ID: <B65BDEAC-8ED1-41A6-DFD2-7F10E99D432B@mfa.uz>
Subject: hello
To: "nyhetsbrev" <nyhetsbrev@sf.se>
Reply-To: "=?UTF-8?B?bGlsbGFfbWFuZ2E5NA==?=" <lilla_manga94r@msn.com>
X-Mailer: iPhone Mail (15B150)
Return-Path: sco@mfa.uz
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 8e76ef3c-4dbc-41ce-b75d-23946e02f2a9:0
X-Forefront-Antispam-Report: CIP:195.158.27.138;IPV:NLI;CTRY:UZ;EFV:NLI;
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: d3f3f125-1b26-4933-8127-08d771a90ce7
X-MS-TrafficTypeDiagnostic: AM0PR02MB5812:
X-MS-Exchange-PUrlCount: 1

   


https://xurl.es/ucn73

--47229137-3dbd-47e6-8ebe-38ec5422f722--











Received: from post.mfa.uz (LHLO post.mfa.uz) (172.30.30.179) by post.mfa.uz
 with LMTP; Mon, 25 Nov 2019 18:11:36 +0500 (UZT)
Received: by post.mfa.uz (Postfix)
   id 2A815180465A54; Mon, 25 Nov 2019 18:11:36 +0500 (+05)
Date: Mon, 25 Nov 2019 18:11:36 +0500 (+05)
From: MAILER-DAEMON@post.mfa.uz (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: sco@mfa.uz
Auto-Submitted: auto-replied
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
   boundary="B164118083E59A.1574687496/post.mfa.uz"
Content-Transfer-Encoding: 7bit
Message-Id: <20191125131136.2A815180465A54@post.mfa.uz>

This is a MIME-encapsulated message.

--B164118083E59A.1574687496/post.mfa.uz
Content-Description: Notification
Content-Type: text/plain; charset=us-ascii

This is the mail system at host post.mfa.uz.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<victor@mission101.se>: Host or domain name not found. Name service error for
    name=mission101.se type=A: Host not found

--B164118083E59A.1574687496/post.mfa.uz
Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns; post.mfa.uz
X-Postfix-Queue-ID: B164118083E59A
X-Postfix-Sender: rfc822; sco@mfa.uz
Arrival-Date: Mon, 25 Nov 2019 18:11:35 +0500 (+05)

Final-Recipient: rfc822; victor@mission101.se
Original-Recipient: rfc822;victor@mission101.se
Action: failed
Status: 5.4.4
Diagnostic-Code: X-Postfix; Host or domain name not found. Name service error
    for name=mission101.se type=A: Host not found

--B164118083E59A.1574687496/post.mfa.uz
Content-Description: Undelivered Message
Content-Type: message/rfc822

Return-Path: <sco@mfa.uz>
Received: from localhost (localhost [127.0.0.1])
   by post.mfa.uz (Postfix) with ESMTP id B164118083E59A
   for <victor@mission101.se>; Mon, 25 Nov 2019 18:11:35 +0500 (+05)
Received: from post.mfa.uz ([127.0.0.1])
   by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10032)
   with ESMTP id Arhh4JBV9prU for <victor@mission101.se>;
   Mon, 25 Nov 2019 18:11:35 +0500 (+05)
Received: from localhost (localhost [127.0.0.1])
   by post.mfa.uz (Postfix) with ESMTP id 2FB0418083E59C
   for <victor@mission101.se>; Mon, 25 Nov 2019 18:11:35 +0500 (+05)
DKIM-Filter: OpenDKIM Filter v2.10.3 post.mfa.uz 2FB0418083E59C
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mfa.uz;
   s=9B56E9CC-C7EF-11E9-8457-543D24A30CEF; t=1574687495;
   bh=lH/hsWNiCk6+Wg2x5iPmjTqJHHybCwuUR+O9CZECttk=;
   h=From:MIME-version:Date:Message-Id:To;
   b=WVSUR0RIXCCRBF3MVhqEeJMK3K0MDRQOe75IJGS5GYEU1hjYl5sxZ++RFiRj2hn8c
    QVAkL3ENQ8SCZomnTG/WRQ8FMnsxQlqLjdMLbYc5+aeDNsWBYTB9h7YHadj18LW34h
    LRXPYNh+N5gGZ4A+87BN/Trpxgsl1BZvt3QCTsOo=
X-Virus-Scanned: amavisd-new at
Received: from post.mfa.uz ([127.0.0.1])
   by localhost (post.mfa.uz [127.0.0.1]) (amavisd-new, port 10026)
   with ESMTP id Ut24cb2tYCiM for <victor@mission101.se>;
   Mon, 25 Nov 2019 18:11:35 +0500 (+05)
Received: from post.mfa.uz (unknown [61.6.247.92])
   by post.mfa.uz (Postfix) with ESMTPSA id 3BDBF18083B361
   for <victor@mission101.se>; Mon, 25 Nov 2019 18:11:34 +0500 (+05)
Content-transfer-encoding: 7bit
From: "JoJo M&amp;229;rtensson" <lilla_humla@mfa.uz>
Content-type: text/plain; charset=us-ascii
MIME-version: 1.0 (1.0)
Date: Mon, 25 Nov 2019 14:10:02 +0100
Message-Id: <D9650E5A-3942-4AC0-9793-C155940FDB41@mfa.uz>
Subject:
To: "victor" <victor@mission101.se>
Reply-To: "JoJo M&amp;229;rtensson" <lilla_humlar@hotmail.com>
X-Mailer: iPhone Mail (15E302)

 



https://xurl.es/hjpdf

--B164118083E59A.1574687496/post.mfa.uz--


phoenix
Ambassador
Ambassador
Posts: 26409
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: Zimbra 8.7.11 periodically sends lots of spam emails

Postby phoenix » Tue Nov 26, 2019 8:54 am

When you post the ZCS version, you should always post the full output pf the following command (it gives more useful information than just the file name):

Code: Select all

zmcontrol -v
Have you checked to see if your server has been hacked? There's a thread in this forum that describes the CVE exploit.
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168
hikauz
Posts: 6
Joined: Thu Oct 19, 2017 12:45 pm

Re: Zimbra 8.7.11 periodically sends lots of spam emails

Postby hikauz » Tue Nov 26, 2019 1:00 pm

[zimbra@post ~]$ zmcontrol -v
Release 8.7.11_GA_1854.RHEL7_64_20170531151956 RHEL7_64 FOSS edition.

What CVE exploit exactly should I check?
phoenix
Ambassador
Ambassador
Posts: 26409
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: Zimbra 8.7.11 periodically sends lots of spam emails

Postby phoenix » Tue Nov 26, 2019 1:06 pm

It's fairly obvious which thread I'm talking about if you look at the Administrator forum.
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168
User avatar
zimico
Advanced member
Advanced member
Posts: 158
Joined: Mon Nov 14, 2016 8:03 am
Location: Vietnam
ZCS/ZD Version: 8.8.15 P3
Contact:

Re: Zimbra 8.7.11 periodically sends lots of spam emails

Postby zimico » Wed Nov 27, 2019 2:47 am

Could you review the daily report to see if any account is compromised?
Best regards,
Minh.
P/S: for CVE exploit that we are talking about: http://forums.zimbra.org/viewtopic.php? ... ab4e53c66e
hikauz
Posts: 6
Joined: Thu Oct 19, 2017 12:45 pm

Re: Zimbra 8.7.11 periodically sends lots of spam emails

Postby hikauz » Wed Nov 27, 2019 1:12 pm

Ok, I started reading the post

Also read https://lorenzo.mile.si/zimbra-cve-2019 ... ction/961/

I think, my system was pwned.

Because I found 3 strange users with global administrative privileges - rnna95, gpu0w4 and 4efh

How find out who and how created these users?
phoenix
Ambassador
Ambassador
Posts: 26409
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: Zimbra 8.7.11 periodically sends lots of spam emails

Postby phoenix » Wed Nov 27, 2019 1:18 pm

Read the whole thread there are details in there on how to clean your server. You could also run-up a new server and move everything to that with ZeXtras Migration Tool.
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168

Return to “Administrators”

Who is online

Users browsing this forum: Google [Bot] and 7 guests