Kingsfordweg 151, 1043GR Amsterdam, The Netherlands ● 24/7 support — support@novogara.com
Novogara BV
Knowledge base

Spam complaints

A spam report against your server is almost never deliberate. It is nearly always a stolen mailbox password or an exploited web form.

Find out what sent it

Start with the queue:

postqueue -p | tail -20

Thousands of queued messages to addresses you do not recognise answers the question immediately. Then find the sender:

grep sasl_username /var/log/mail.log | awk '{print $NF}' | sort | uniq -c | sort -rn | head

One account sending far more than the others is your compromise. If nothing is authenticated, it is a script: look for mail injected locally by the web server user, which points at a contact form or an exploited application.

Stop it before anything else

  1. Disable the account or the script
  2. Flush the spam out of the queue — postsuper -d ALL if everything queued is spam, or delete selectively if legitimate mail is mixed in
  3. Change the password, and check whether the same one is used elsewhere
  4. Then look for how they got in — see a compromised server

Do not skip the last step. A changed password fixes the symptom; if the application has a vulnerability, it will happen again next week.

Tell us what you found

Reply to the complaint with what happened and what you changed. A customer who comes back within the hour with a diagnosis is in a completely different position from one who goes quiet — see what to do with an abuse notice.

Then repair the reputation

Check which blocklists you are on and work through them in order: cause first, delisting second. Requesting removal while mail is still leaving is how a first listing becomes a pattern. See getting off a blocklist.

Large providers also run private reputation systems with no delisting form. Those recover with time and consistent behaviour — low volume, clean recipients, correct authentication. Days to weeks, and sending more does not speed it up.

Make it harder next time

  • Rate-limit outgoing mail per account. One stolen password should produce a few hundred messages and an alert, not fifty thousand.
  • Alert on queue length. It is the earliest signal you will get.
  • Require authentication on 587 and 465, and never relay openly — see port 25, 587 and 465.
  • Protect your forms. Most web-form spam is stopped by a timestamp check and a honeypot field.
  • Keep the application patched. Outdated WordPress is the single most common entry point — see WordPress and automatic security updates.
  • Enforce decent passwords on mailboxes, and two-factor where your platform supports it.

Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base