Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am getting an error message to unknow user on my domain. I would like to know is this just a phishing spam email or it was really send from our domain? I have changed our domain name to OURDOMAIN.COM

I have Exchange 2010 installed.

Body of the email is

Delivery has failed to these recipients or distribution lists:

The recipient's e-mail address was not found in the recipient's e-mail system. Microsoft Exchange will not try to redeliver this message for you. Please check the e-mail address and try resending this message, or provide the following diagnostic text to your system administrator.
Sent by Microsoft Exchange Server 2007 

Diagnostic information for administrators:

Generating server: murraygroup.local
#550 5.1.1 RESOLVER.ADR.RecipNotFound; not found ##

Original message headers:

Received: from ( by
 mih-exca-01.murraygroup.local ( with Microsoft SMTP Server id; Fri, 29 Jun 2012 12:36:12 +0100
Received: from (HELO
 ([])  by with SMTP; 29 Jun 2012 12:42:48
Received: from[])
 by ; Fri, 29 Jun 2012 12:37:18 BST
Received: from [] ([])    by (8.13.1/8.12.8) with ESMTP id q5TBbH4j022142   for
 <>; Fri, 29 Jun 2012 12:37:18 +0100
Date: Fri, 29 Jun 2012 12:37:17 +0100
Message-ID: <20120629145229.4C2A817231D8A7958044@SONW>
From: Ines Hampton <CarmenF77297@OURDOMAIN.COM>
To: sales <>
Reply-To: Marguerite Soto <>
Subject: User sales
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Return-Path: CarmenF77297@OURDOMAIN.COM

eporting-MTA: dns;murraygroup.local
Received-From-MTA: dns;
Arrival-Date: Fri, 29 Jun 2012 11:36:12 +0000

Final-Recipient: rfc822;
Action: failed
Status: 5.1.1
Diagnostic-Code: smtp;550 5.1.1 RESOLVER.ADR.RecipNotFound; not found
X-Display-Name: sales
share|improve this question
up vote 4 down vote accepted

It's spam.

Received: from (HELO


Reply-To: Marguerite Soto

Indicate it didn't come from your user at your domain. It came in from (and if you look, you can see where that server received the emailfrom and trace it back some) and it has a reply to address to some Islamic school organization (weird), so it's safe to assume this is backscatter spam.

share|improve this answer
Backscatter I think is the more common term? – EightBitTony Jun 29 '12 at 13:47
Also the correct one. Thanks, I'll fix that now... and pay more attention to the spelling corrections my browser offers. – HopelessN00b Jun 29 '12 at 14:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.