technical administration anyone

[TomMix]

i know it is all about the music but is anyone out there who can fix mercuryservers emailsetup?

to support the fixing i paste the output of a simple gai-analysis:

Key things to look for in an email header analysis:
1. Authentication results (SPF, DKIM, DMARC)
2. Sender verification
3. Routing path
4. Potential spoofing indicators
5. TLS encryption
6. Script execution paths
7. Domain mismatches

Let me go through this systematically:

**Return-Path and Sender Address Mismatch:**
- Return-Path: mercserv@tk.mjwebhosting.com
- From: "[ms]" <kamaldatta@gmail.com>
- This is a RED FLAG - the actual sender is from tk.mjwebhosting.com, but the "From" header displays kamaldatta@gmail.com. This is classic spoofing.

**Authentication Results:**
- SPF: none (no SPF record) - No SPF protection
- DKIM: Signed from mercuryserver.com domain
- No DMARC mentioned

**IP Address Analysis:**
- Client IP: 23.111.137.106
- HELO: 23-111-137-106.static.hvvc.us
- This appears to be from a hosting provider (HVVC)

**Domain Mismatches:**
- Return-Path: tk.mjwebhosting.com
- DKIM-Signature domain: mercuryserver.com
- From: kamaldatta@gmail.com
- This is very suspicious - multiple domain inconsistencies

**TLS/Encryption:**
- Uses TLSv1.3 with strong cipher (TLS_AES_256_GCM_SHA384) - Good
- RSA-PSS 4096 bits - Good
- The email was generated from a web application, likely a forum notification, based on the PHP script headers showing www.mercuryserver.com/forums/index.php and mail.php execution paths. Multiple red flags stand out: the Gmail address spoofing combined with no SPF protection, the mismatched domains across Return-Path, DKIM, and From headers, and the auto-submitted flag all suggest this could be a compromised or malicious forum system. The display name "[ms]" further obscures the actual sender identity.## Email Header Analysis

I've identified several **security concerns** in this email header that warrant attention. This message exhibits multiple characteristics consistent with spoofing or phishing tactics.

---

## Critical Red Flags

**Sender Identity Mismatch (High Risk)**

| Component | Value | Status |
|-----------|-------|--------|
| **Return-Path** | mercserv@tk.mjwebhosting.com | Actual sender |
| **From Header** | "[ms]" <kamaldatta@gmail.com> | Displayed to recipient |
| **Domain in Use** | mercuryserver.com (DKIM) | Authenticated domain |

The email **claims to originate from a Gmail address but actually comes from a hosting server** (tk.mjwebhosting.com). This is a textbook spoofing technique—the From header does not match the actual sending server.

---

## Authentication Weaknesses

**SPF (Sender Policy Framework): NONE**
The sending domain has **no SPF record**, meaning there's no published authentication policy. This allows anyone to send email claiming to be from that domain.

**DKIM Signature Present**
The email is signed by mercuryserver.com, but this doesn't verify the Gmail address in the From field.

**No DMARC Policy**
No DMARC (Domain-based Message Authentication) is implemented, which would enforce authentication standards.

---

## Additional Suspicious Indicators

- **Multiple domain inconsistencies**: tk.mjwebhosting.com, mercuryserver.com, mail.com, and kamaldatta@gmail.com are all referenced
- **PHP script execution visible**: X-PHP-Script headers expose the originating application path (forums/index.php)
- **Auto-submitted flag**: Marked as auto-generated, which is typical for legitimate forum notifications but also for automated attack tools
- **Unsubscribe link contains user ID and hash**: The List-Unsubscribe URL includes sensitive identifiers that could be exploited

---

## Verdict

**This email is likely spoofed or from a compromised system.** While it may genuinely be a forum notification, the sender address forgery is a serious security issue. The absence of SPF protection and domain misalignment create an ideal condition for abuse.

**Recommended Actions:**
- Do not click links or download attachments unless you independently verify the sender
- Report this to your email administrator
- Check if your forum account (mercuryserver.com) has been compromised

good luck, have fun, dont die!

[Kamal]

Whats this about? I havent really worried about ms emails cause ... well everyone in the team left LOL. I think Im all thats left unless there's folks that wanna revive the crew.

[TomMix]

Whats this about?
I havent really worried about ms emails

so i guess your not that tech-savvy on emailtransport configuration.
are you interested to fix this at all?

cause ... well everyone in the team left LOL. I think Im all thats left unless there's folks that wanna revive the crew.

at least this explains why it is what it is.
so you are alone administering?
if you like i can try to help you fix this issue ...

[Kamal]

I dont get down to the nitty gritty but I solve problems. Dont worry I'll take care of it. Why was this an issue is what Im curious about. You trying to send email?

[TomMix]

I dont get down to the nitty gritty but I solve problems. Dont worry I'll take care of it.

great!
it is easy to solve.
all relevant data is inside the summary i have posted above!
fix:
- Sender Identity Mismatch
- missing SPF
- missing DMARC

Why was this an issue is what Im curious about. You trying to send email?

i was away for a while from my mailbox and as i returned a few days ago
this 'malfunction' caught my attention. i am happy to point this out even though i am not sure
whether it is a good or bad sign that no one has done so yet ...

good luck, have fun, dont die!

[TomMix]

here is a spamassassin report of the [ms] notifications email:

Content analysis details:   (8.7 points, 4.5 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.0 SPF_HELO_NONE          SPF: HELO does not publish an SPF Record
 0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is
                            CUSTOM_MED
 0.0 SPF_NONE               SPF: sender does not publish an SPF Record
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
-0.0 BAYES_20               BODY: Bayes spam probability is 5 to 20%
                            [score: 0.1022]
 0.0 FROM_LOCAL_HEX         From: localpart has long hexadecimal sequence
 0.0 FROM_LOCAL_DIGITS      From: localpart has long digit sequence
 0.0 TVD_RCVD_IP            Message was received from an IP address
 0.0 CK_HELO_GENERIC        Relay used name indicative of a Dynamic Pool or
                            Generic rPTR
 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
                            domains are different
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
                            [kamaldatta(at)gmail.com]
 1.0 FORGED_GMAIL_RCVD      'From' gmail.com does not match 'Received' headers
 0.8 RDNS_NONE              Delivered to internal network by a host with no rDNS
 0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
                             freemail headers are different
 2.5 PHP_SCRIPT             Sent by PHP script
 0.9 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing list
 0.2 HELO_MISC_IP           Looking for more Dynamic IP Relays
 3.0 FROM_ADDR_WS           Malformed From address

good luck, have fun, dont die!

[Kamal]

its just a mismatch between Exim and server signature with cpanel, my server AI will fix it before the end of the day.

[Kamal]

Hey Tom, thanks for pointing that out, my local AI "Cody" fixed it. If you want to read his technical report, happy to paste it in here. Im 50, I dont read technical reports, I orchestrate.