Software

Ask something
Discussion Locked

Spoofed email domain

0 helpful
5 replies

by santo.recchia

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

As the head of systems for a small business, i receive all email that is addressed to my email domain (@jlem.com) but for which there is no valid email prefix. Today, I am receiving several 'Undliverable' email messages that say they were sent from some random email name, but with my mail domain (@jlem.com).

I am assuming this means that my email domain was spoofed for purposes of sending a spam email.I am very concerned about the having our email domain added to black list servers and also about the the general reputation of the firm.

What can I do about this?

5 replies

by [_rick_>

For starters you will want to turn off Relaying from your system and also force Reverse DNS look up to verify that a message originates where is states it does.

You can also check the RFC822 header of the message to determine where it is being originated from and report them back to the ISP. One place to check on the original ISP from a IP address is with Geektool Whois found here (remove any spaces):

http://www.geektools.com/cgi-bin/proxy.cgi

There are also 3rd party tools that will help in preventing relaying and spamming against your system, but befo reI went that route I'd check on teh configuration of your current email server to verify that it is not wide open for relaying and spamming. If you are getting your own spoofed address, then you can pretty much guarantee that others are also.

If you could send me the type of e-mail server you have I'll see what info I have to help stop relaying.

Good luck

Rick

by santo.recchia

I really don't think they are relaying from my email server. I know that we've closed that port a while ago.
I think the spammer is just using my email domain name as the sender so that when an undeliverable mesage is generated,it comes back to me.

by sgt_shultz

you might find, if you force reverse name lookup, that you might exclude mail from places you wish to receive from...they have to have their dns properly configured and sometimes they don't...

by [_rick_>

Is port 25 closed? This is the SMTP port.

Port 25 is all that is needed for a spammer, hacker, whoever to access your server from the internet. To verify if relaying is really disabled on your box open a telnet session to the servers IP address and port 25 - also doing this will tell you is you can access your SMTP service from the Internet.

Ex:telnet 10.10.10.10 25

If you send a message via the SMTP server then relaying is active.
------

There are worms that will spoof a domain address, but it does so by finding a true account address to use at random. It wouldn't create an invalid account.

To check on the actual location of the message take a look at the message's header data. It will provide you with an indepth routing of hte message. You will be able to determien exactly where it came from (90% of the time). If it is a worm this header will point back tot eh company that is infected.

Now if it is a hacker, good luck. They have ways of desguising the header. To check this you will need to have a Netowrk Monitor capturin gall of the packets hitting your server on port 25.

Good luck
Rick

This discussion is closed to new replies.