Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

One of my clients is getting thousands of "Delivery Status Notification (Failure)" emails per day and it's replied to random email accounts that don't exist on the domain. The content of the emails that bounce back have spam links to porn sites. So someone is obviously using the domain to send out spam, but i'm not sure if they've hacked the server or if they're just spoofing.

I have been looking into the email settings in cPanel to see if I can restrict this. I came across the DKIM and SPF settings under Email Authentication. I've enabled both of these but the emails keep coming through.

share|improve this question

marked as duplicate by Dennis Kaarsemaker, BMDan, Bryan, mdpc, Michael Hampton May 31 '13 at 20:17

This question was marked as an exact duplicate of an existing question.

The From address on an e-mail is akin to writing a From address on a regular snail mail. There isn't much that can be done. See @Tom Marenthal's comment. – artifex May 31 '13 at 20:10

The sender address is very easy to spoof. You can do it with nothing more than a command prompt/shell and a telnet command.

It's almost certainly not a compromised system, this kind of thing goes on all the time and there is very little you can do about it.

If you are concerned, check the message headers as that will reveal the IP source of the message.

share|improve this answer
Thanks Brian, the message headers say Received: from ([]:37736) by with esmtp (Exim 4.80) id 1UiUKJ-001Uhm-E7 for; Sat, 01 Jun 2013 04:45:24 +1000 Received: from localhost by; 01 Jun 2013 04:45:21 +1000 – Paul Mason May 31 '13 at 19:41
Because they're bounced back emails won't the headers come from the bounce back service on the server and not the original sender? – Paul Mason May 31 '13 at 19:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.