i know it is all about the music but is anyone out there who can fix mercuryservers emailsetup?

to support the fixing i paste the output of a simple gai-analysis:

[QUOTE]Key things to look for in an email header analysis:

1. Authentication results (SPF, DKIM, DMARC)
2. Sender verification
3. Routing path
4. Potential spoofing indicators
5. TLS encryption
6. Script execution paths
7. Domain mismatches

Let me go through this systematically:

Return-Path and Sender Address Mismatch:

• Return-Path: [email]mercserv@tk.mjwebhosting.com[/email]
• From: "[ms]" kamaldatta@gmail.com
• This is a RED FLAG - the actual sender is from tk.mjwebhosting.com, but the "From" header displays [email]kamaldatta@gmail.com[/email]. This is classic spoofing.

Authentication Results:

• SPF: none (no SPF record) - No SPF protection
• DKIM: Signed from mercuryserver.com domain
• No DMARC mentioned

IP Address Analysis:

• Client IP: 23.111.137.106
• HELO: 23-111-137-106.static.hvvc.us
• This appears to be from a hosting provider (HVVC)

Domain Mismatches:

• Return-Path: tk.mjwebhosting.com
• DKIM-Signature domain: mercuryserver.com
• From: [email]kamaldatta@gmail.com[/email]
• This is very suspicious - multiple domain inconsistencies

TLS/Encryption:

• Uses TLSv1.3 with strong cipher (TLS_AES_256_GCM_SHA384) - Good
• RSA-PSS 4096 bits - Good
• The email was generated from a web application, likely a forum notification, based on the PHP script headers showing [url]www.mercuryserver.com/forums/index.php[/url] and mail.php execution paths. Multiple red flags stand out: the Gmail address spoofing combined with no SPF protection, the mismatched domains across Return-Path, DKIM, and From headers, and the auto-submitted flag all suggest this could be a compromised or malicious forum system. The display name "[ms]" further obscures the actual sender identity.## Email Header Analysis

I've identified several security concerns in this email header that warrant attention. This message exhibits multiple characteristics consistent with spoofing or phishing tactics.

---

Critical Red Flags

Sender Identity Mismatch (High Risk)

Component	Value	Status
Return-Path	[email]mercserv@tk.mjwebhosting.com[/email]	Actual sender
From Header	"[ms]" kamaldatta@gmail.com	Displayed to recipient
Domain in Use	mercuryserver.com (DKIM)	Authenticated domain

The email claims to originate from a Gmail address but actually comes from a hosting server (tk.mjwebhosting.com). This is a textbook spoofing technique—the From header does not match the actual sending server.

---

Authentication Weaknesses

SPF (Sender Policy Framework): NONE The sending domain has no SPF record, meaning there's no published authentication policy. This allows anyone to send email claiming to be from that domain.

DKIM Signature Present The email is signed by mercuryserver.com, but this doesn't verify the Gmail address in the From field.

No DMARC Policy No DMARC (Domain-based Message Authentication) is implemented, which would enforce authentication standards.

---

Additional Suspicious Indicators

• Multiple domain inconsistencies: tk.mjwebhosting.com, mercuryserver.com, mail.com, and [email]kamaldatta@gmail.com[/email] are all referenced
• PHP script execution visible: X-PHP-Script headers expose the originating application path (forums/index.php)
• Auto-submitted flag: Marked as auto-generated, which is typical for legitimate forum notifications but also for automated attack tools
• Unsubscribe link contains user ID and hash: The List-Unsubscribe URL includes sensitive identifiers that could be exploited

---

Verdict

This email is likely spoofed or from a compromised system. While it may genuinely be a forum notification, the sender address forgery is a serious security issue. The absence of SPF protection and domain misalignment create an ideal condition for abuse.

Recommended Actions:

• Do not click links or download attachments unless you independently verify the sender
• Report this to your email administrator
• Check if your forum account (mercuryserver.com) has been compromised[/QUOTE]

good luck, have fun, dont die!

Whats this about? I havent really worried about ms emails cause ... well everyone in the team left LOL. I think Im all thats left unless there's folks that wanna revive the crew.

[QUOTE=Kamal;n1932209]Whats this about? I havent really worried about ms emails [/QUOTE] so i guess your not that tech-savvy on emailtransport configuration. are you interested to fix this at all? [QUOTE=Kamal;n1932209] cause ... well everyone in the team left LOL. I think Im all thats left unless there's folks that wanna revive the crew. [/QUOTE] at least this explains why it is what it is. so you are alone administering? if you like i can try to help you fix this issue ...

I dont get down to the nitty gritty but I solve problems. Dont worry I'll take care of it. Why was this an issue is what Im curious about. You trying to send email?

[QUOTE=Kamal;n1932212]I dont get down to the nitty gritty but I solve problems. Dont worry I'll take care of it.[/QUOTE] great! it is easy to solve. all relevant data is inside the summary i have posted above! fix:

• Sender Identity Mismatch
• missing SPF
• missing DMARC [QUOTE=Kamal;n1932212] Why was this an issue is what Im curious about. You trying to send email?[/QUOTE] i was away for a while from my mailbox and as i returned a few days ago this 'malfunction' caught my attention. i am happy to point this out even though i am not sure whether it is a good or bad sign that no one has done so yet ...

good luck, have fun, dont die!

here is a spamassassin report of the [ms] notifications email: [CODE]Content analysis details: (8.7 points, 4.5 required)

pts rule name description

---

0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.0 BAYES_20 BODY: Bayes spam probability is 5 to 20% [score: 0.1022] 0.0 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence 0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or Generic rPTR 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [kamaldatta(at)gmail.com] 1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom freemail headers are different 2.5 PHP_SCRIPT Sent by PHP script 0.9 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list 0.2 HELO_MISC_IP Looking for more Dynamic IP Relays 3.0 FROM_ADDR_WS Malformed From address [/CODE]

good luck, have fun, dont die!

its just a mismatch between Exim and server signature with cpanel, my server AI will fix it before the end of the day.

Hey Tom, thanks for pointing that out, my local AI "Cody" fixed it. If you want to read his technical report, happy to paste it in here. Im 50, I dont read technical reports, I orchestrate.

indeed i would like to read the report.

[QUOTE=Kamal;n1932219]Hey Tom, thanks for pointing that out, ...[/QUOTE] ur welcome! 8)

now my spamassassin likes the [ms] notifications :WinkNSmi: