Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I got a report from my root server provider of abuse - someone has been sending phishing mail through my server's Postfix (the headers originate from my server's IP). What should I check for? The server itself doesn't seem to be hacked.

share|improve this question
It doesn't need to be hacked if it is misconfigured - try – symcbean Jun 14 '12 at 15:11
up vote 2 down vote accepted

inspecting full headers of phishing mails can contains some clues. there are few options:

  • messages came from your server and via postifx - then you should be able to find corresponding entries in postfix log
  • messages came from your server but not via postfix - maybe there was some rouge code that implemented own smtp sender or maybe someone relied ip traffic via your server [think ssh tunnel]
  • messages never passed your box [i doubt it's the case but it's possible to hijack a route]
share|improve this answer
It's the first case – Kornel Kisielewicz Jun 14 '12 at 13:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.