Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have recently been receiving spam that has been listed as my own email address. I remember doing a few telenet emails back in school and know there are some ways to send looking like they are coming from a different place but wanted to ask others opinions on this. The server is a Zimbra 6.06 server running on Debian lenny. Does anyone think there is possibly something wrong with the setup here or is this just some spoofing going on? I can see that the email is coming from outside of the network of course.

Return-Path: 0-ka@ps.ge.com
Received: from zimbra.example.com (LHLO zimbra.example.com) (10.0.0.1) by
 zimbra.example.com with LMTP; Tue, 10 May 2011 06:00:40 -0500 (CDT)
Received: from localhost (localhost [127.0.0.1])
    by zimbra.example.com (Postfix) with ESMTP id D2B9759FC5
    for <grant@example.com>; Tue, 10 May 2011 06:00:40 -0500 (CDT)
X-Virus-Scanned: amavisd-new at zimbra.example.com
X-Spam-Flag: YES
X-Spam-Score: 8.593
X-Spam-Level: ********
X-Spam-Status: Yes, score=8.593 tagged_above=-10 required=6.6
    tests=[BAYES_99=3.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_XBL=3.033,
    RDNS_NONE=0.1] autolearn=no
Received: from zimbra.example.com ([127.0.0.1])
    by localhost (zimbra.example.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 5Be4Ob1KSuhu for <grant@example.com>;
    Tue, 10 May 2011 06:00:39 -0500 (CDT)
Received: from [81.211.11.134] (unknown [81.211.11.134])
    by zimbra.example.com (Postfix) with ESMTP id 44CBC59D4F
    for <grant@example.com>; Tue, 10 May 2011 06:00:39 -0500 (CDT)
Received: from 81.211.11.134(helo=example.com)
    by example.com with esmtpa (Exim 4.69)
    (envelope-from )
    id 1MMKY8-2034hf-28
share|improve this question
    
I use Postini as my anti-spam gateway and have rules to drop any mail received from mydomains.com as anything internal would never see the outside. –  gravyface May 10 '11 at 13:16

2 Answers 2

up vote 6 down vote accepted

Having a properly configured SPF record can alleviate a little bit of that pain.

It will prevent someone from sending email claiming it is from your domain.

share|improve this answer
1  
Well, it will if in addition to publishing a well-configured SPF record you also configure your MTA to check SPF records on incoming email. But I agree, this is well-worth doing. –  MadHatter May 10 '11 at 13:15
    
looking into that now, thanks. –  grantk May 10 '11 at 13:26
    
I followed the instructions here for SPF, pyzor, and razor and am still seeing some spoofing going on. I do not see anything indicating that my MTA should check the SFP records. Anyone know how to force that on zimbra? wiki.zimbra.com/… –  grantk May 10 '11 at 17:25

You can write anything in the "From" header field of an email. Try it with standard mail command on any Linux box:

$ mail -a "From: rms@gnu.org" -s "Richard Stallman here!" <your_email_address>
share|improve this answer
    
heh, I did not know he knew my email address! I was just curios as to whether or not there was anything I was possibly doing wrong on the server side. But I assume not, although I am curious how they got the emails, spoofed an awful lot of them, as well as some alias used internally mostly, but if this one was answered that would probably be a very rich man then. –  grantk May 10 '11 at 13:12
    
They don't need to know your email address. Normally they will try ten of thousands of possible combinations (or maybe much more), most of which will not get delivered, but a handful of them will be valid addresses and so do get delivered. Unless you have a catchall address, you must likely don't know anything about all the others. –  sgmoore May 10 '11 at 13:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.