Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Somehow, rogue spam emails are being sent through my domain from I'm using google apps to manage email, and I see no test user account, so I'm not sure what could possibly be happening.

Where should I start to debug this?

share|improve this question
I guess question one is: what do you mean by "rogue spam emails are being sent through my domain"? Presumably you have some concrete evidence of this, hopefully in the form of a bounce, or perhaps an abuse report. Could you let us see what you've got, then we can better advise you? – MadHatter Dec 13 '10 at 20:26
up vote 4 down vote accepted

You might want to look at the email headers and determine if the email is actually being sent from your server at all. It's easy to make the email appear as if it were coming from any address, even a non-existent one.

share|improve this answer
Looking at the headers, it seems as if I was getting an "SPF neutral" message with weird information. I'm setting up SPF records now, as it seems the email was just being spoofed. – Stefan Kendall Dec 13 '10 at 20:57

Anyone can send emails that appear to come from any other source domain! This is just how smtp works, which is why there is loads of spam floating around :/ Now, your best chance of fighting this, is to create a SPF record from your domain. The SPF record declares authoritative email servers, that can send email in the name of your domain. Thus, any other spam servers would not be able to send masquerading as you. Well they still could, but the receiving end should verify SPF, find out they're scammers, and then reject that email

Learn more about SPF and implementing it at

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.