Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a domain name 2m.lt registered and added to google apps. There is an option there that all the email adressed to my domain (*@2m.lt) is forwarded to my mail email account (admin@2m.lt).

Well one week ago I have started seeing 3 to 6 emails every day sent from postmasters around the world saying that recipients could not be found. I looked at the mail and it says that someone tried to send an email to non existing address. The source address was: @2m.lt

It seems that someone is sending emails around the world and setting FROM field to random generated accounts BUT with my domain at the end. All this strange email that I have got is only for those cases where recipient is not found. I would imagine that lots of spam is received by someone from my domain.

I have exported these messages and you can look at them here: http://6.latest.formytestingaction.appspot.com/

I have changed my main account (admin@2m.lt) password but these messages still keep going into my mail box. Any suggestions what should I do?

I have tried to ask in Google Apps Forums with no avail.

share|improve this question

3 Answers 3

The email protocol is totally insecure. Anyone can set the From line to anything they want, and there's basically nothing you can do about it.

These people don't need access to your email account - they just send the emails from their own servers, setting the From line to whatever they want.

You get the bounce messages because the receiving servers simply follow protocol and send an error report to the From / Reply-To address.

If you examine the Received headers from the original message, you'll see the messages were never sent from the Google servers.

There have been attempts, such as DomainKeys, to provide systems that allow people to verify that an email was sent by the reported sender, but these completely rely on the receiving servers implementing them. At best, many servers only implement these systems to help mark spam.

Welcome to the Internet

share|improve this answer
up vote 3 down vote accepted

Well it seems that there is something I can do. There is a validation system called Sender Policy Framework. It works like this:

  1. spammer wants to send an email with a forged FROM header which uses my domain.
  2. SMTP server which spammer connects to gets a DNS TXT record for the domain in a FROM header.
  3. TXT record contains IP addresses that mail from my domain can originate from, so
  4. if a spammer's IP address is not in that list, this mail gets rejected.

SPF is something that every domain should have. In my Google Apps case there is a site here which tells how to set it up.

Of course this depend on SMTP servers having implemented this, but it is better than nothing.

share|improve this answer
    
No... there's nothing you can do. You can't make me turn on SPF if I don't want to. I'm not saying that to be funny, but the point is that you can't control what other people send to yet other people. –  RobM Oct 2 '10 at 17:28
1  
That is not the point. By adding SPF entry I will stop spammers that send spam using my domain via servers that implement SPF. This is something I can do. –  BlinK_ Oct 2 '10 at 17:33
1  
So what is the point? I mean yes you're correct there, but you need to be realistic about the outcome: You asked what you could do to stop forged emails and this won't do that completely. As I said before, I'm not trying to be awkward, I just think you need to be clear about how email works - and where it's broken. –  RobM Oct 2 '10 at 17:51
1  
its better than doing nothing. Add a SPF record to your domain it helps some, but not completely. –  aduljr Oct 2 '10 at 18:02

There isn't anything you can do about this. Spoofing the sender's address in an email message is trivially easy.

share|improve this answer
    
Oh, I see. And I cant really see the sender MAIL server, because all of these are responses from legit mail servers. –  BlinK_ Sep 29 '10 at 14:18
    
Well I will comment on my comment, because I can actually see the IP of the spammer because many of these automated replies will have the original message with all of its headers. I have learned all about this problem from the Security Now podcast here grc.com/securitynow.htm#79 –  BlinK_ Oct 2 '10 at 18:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.