Strange Email From Fishforums

quatermass

New Member
Joined
Nov 6, 2004
Messages
7
Reaction score
0
Location
Livingston, Scotland
Hi Fishforums Admin,

I've noticed that emails from Fishforums.net go right into my spam filter.

I looked into this and it seems you're not sending emails to me from drift.ing.me.uk ([78.46.45.9]) which claims it is in Germany.

Is this right?

My spam filter checks to see if the helo string of your email server matches the domain and well as you can see it doesn't.

It appears to be coming from. But it isn't! It's coming via the Netherlands.

It has no appearance of actually coming from fishforums.net. Does it?

Assuming it is legal. wouldn't it be better to have a real standing from: address on fishforums.net using this domain?
At the moment it has no route back to Fishforums.net.

drift.ing.me.uk is an odd address actually from the Netherlands. So why is fishforums doing this? Do they know they're putting out odd emails?
The helo statement is suppose to match the domain it's coming from.

Seems odd to me that there a gmail address in there? Surely an Admin of this web site should be using the fishforums domain? Even it then forwards privately to the gmail address?

I'm a IT engineer by trade so these things worry me. :)

Here is a typical header I got.
Code:
Return-Path: <@gmail.com>
X-Gradwell-POP3: delivered to <[email protected]> at Sun,  7 Jun 2009 21:29:21 +0100
X-Envelope-To: [email protected]
X-Forwarding-To: [email protected]
Delivered-To: [email protected]
X-Envelope-To: [email protected]
X-Forwarding-To: [email protected]
Delivered-To: [email protected]
X-Gradwell-Mailfilter: Header filter rule X-Gradwell-Warning contains helo matched
X-Gradwell-Mailfilter: redirected to [email protected] by 5338
Received: from sov-mail-b0016.gradwell.net [193.84.87.40] by denali.stor.gradwell.net
	(Gradwell pop3-delivery-daemon); Sun,  7 Jun 2009 21:29:21 +0100
Received: from drift.ing.me.uk ([78.46.45.9] helo=drift country=DE)
		  by sov-mail-b0016.gradwell.net with esmtp (Gradwell gwh-smtpd 1.290) id 4a2c2320.32c.2
		  for [email protected]; Sun,  7 Jun 2009 21:29:20 +0100
		  (envelope-sender <>)
Received: from localhost ([127.0.0.1])
	by drift with smtp (Exim 4.69)
	(envelope-from <>)
	id 1MDPHA-0005Jf-Jl
	for [email protected]; Sun, 07 Jun 2009 22:47:32 +0200
MIME-Version: 1.0
Date: Sun, 07 Jun 2009 22:47:32 +0200
From: "Tropical Fish Forums" <>
To: [email protected]
Subject: [!X-Gradwell-Warning] Your new password Tropical Fish Forums ( Tropical Fish Forums )
X-Priority: 3
X-Mailer: IPB PHP Mailer
Content-type: text/plain; charset="iso-8859-1"
Message-Id: <E1MDPHA-0005Jf-Jl@drift>
X-Gradwell-Warning: helo drift (no domain) from 78.46.45.9


quatermass,
This email has been sent from http://www.fishforums.net/index.php.

This email completes your lost password request.

------------------------------------------------
YOUR NEW PASSWORD
------------------------------------------------

Obviously I can whitelist this. But it seems an odd way to do email. :blink:
 
That is odd that it would go through via the Netherlands. It's always been set up with the address, that is a legit address associated with this forum. While I'm no tech expert, I will have this looked into.

Thanks for the heads up! :good:
 
I'm certainly no techie but could it be the progression of servers it went through from start to finish. Below is the header for one I received from TFF.

Return-Path: <>
Authentication-Results: mta193.mail.ac4.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 78.46.45.9 (EHLO drift) (78.46.45.9) by mta193.mail.ac4.yahoo.com with SMTP; Sun, 07 Jun 2009 07:03:14 -0700
Received: from localhost ([127.0.0.1]) by drift with smtp (Exim 4.69) (envelope-from <m>) id 1MDJFZ-0000N8-BN for [email protected]; Sun, 07 Jun 2009 16:21:29 +0200
MIME-Version: 1.0
Date: Sun, 07 Jun 2009 16:21:29 +0200
From: "Tropical Fish Forums" <> Add sender to Contacts
To: [email protected]
Subject: Forum Subscription New Topic Notification ( Tropical Fish Forums )
Content-type: text/plain; charset="iso-8859-1"
Message-Id: <E1MDJFZ-0000N8-BN@drift>
Content-Length: 1293
 

Most reactions

Back
Top