Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My webmaster catch-all email address started receiving a lot of "Delivery Status Notification (Failure)" replies from various email systems. In the order of 1 per hour.

It's obviously Spam being sent, as the content is about medications. I'm trying to figure out if

1)It is not being sent by us but the reply-to field is being set to our site, and therefore we receive the failure notification or 2) Our system has been compromised and it's being sent by us, hurting our reputation. Also - if this is the case, where do I look to fix the problem?!


Here is an example:

Delivery to the following recipient failed permanently:

 Technical details of permanent failure:
 Google tried to deliver your message, but it was rejected by the recipient domain. We         recommend contacting the other email provider for further information about the cause of    this error. The error that the other server returned was: 550 550 5.1.1   <>... User unknown (state 13).

 ----- Original message -----

 Received: by with SMTP id f6mr6872450bkw.7.1341224023720;
 Mon, 02 Jul 2012 03:13:43 -0700 (PDT)
 Received: by with SMTP id f6mr6872447bkw.7.1341224023673;
 Mon, 02 Jul 2012 03:13:43 -0700 (PDT)
 Return-Path: <>
 Received: from ([])
 by with ESMTP id hi9si10538192bkc.151.2012.;
 Mon, 02 Jul 2012 03:13:39 -0700 (PDT)
 Received-SPF: neutral ( is neither permitted nor denied by   best guess record for domain of client-ip=;
 Authentication-Results:; spf=neutral ( is neither permitted nor denied by best guess record for domain of
 Date: Mon, 02 Jul 2012 03:13:39 -0700 (PDT)
 Message-Id: <20120702131340.6C18454BE719A3A513E9@USER-PC>
 From: Leslie Browning <>
 To: grdchurch <>
 Reply-To: Maryanne Whitehead <>
 Subject: For grdchurch
 Mime-Version: 1.0
 Content-Type: text/plain; charset=utf-8
 Content-Transfer-Encoding: 7bit

 best ED meds! Be confident! Buy here

share|improve this question
It is hard to get started, because I do not know if you only just changed the email to or something other too? – cstamas Jul 2 '12 at 17:55
I would strongly recommend setting up SPF and/or DKIM on your domain. Google and many other mail server check these settings and would have realized the mail wasn't from your server. – Chris S Jul 2 '12 at 18:22
@cstamas I changed the email to and didn't change anything else. – tnichols Jul 2 '12 at 19:15
@chris ok note taken. thanks! – tnichols Jul 2 '12 at 19:15

3 Answers 3

up vote 6 down vote accepted

My first quick check would be whether you're from Saudi Arabia, as the "received-from" IP is from a pool of home DSL users in SA. If not, my first instinct would be that no, it's not from you.

Second you can check your system logs on the mail server, and see if it's showing any outgoing mail.

Third, check that your router is only allowing outgoing activity on port 25 from just your mail server; workstations that are compromised can otherwise send email and it would appear from your outgoing IP.

Fourth would be to run a packet sniffer on the mail server if you want to verify that it isn't sending extra email, or insert a system that can run wireshark/tcpdump between the mail server and the router for a "clean catch" of network traffic, as compromised systems can hide what they're doing if rootkitted.

share|improve this answer

I would start by reviewing your mail server logs for this message. It was given a unique ID number but if your system sent it you should be able to easily at least find the message. If you do find the message there's a good chance your employees computer or device is infected with something. However, you would want to compare the IP address of the device sending the message to what you would expect it to be.

share|improve this answer

Most likely one (or more) of you webpages includes a capability to send mail.

Contact us via this form or something else. Or it is just buggy code. A malicious bot exploits this and sends mail with subverting the original intention (inner workings) of the script.

If you include more info we can try to help getting further.

For a start grep your webserver logs for POST requests. One can identify injected content by finding excessive POST requests in the log.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.