Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I'm hoping the community can help me shed some light on a recent email spoof. Yesterday my client woke up to find hundreds of bounced failure notices.

The client did not personally send any of these emails. Each failure notice had a different reply-to address i.e.

The various reply-to addresses suggest that only the clients domain had been spoofed and not a specific email account (i.e

I know if your email account has been spoofed, it's game over and you need to create a new email address. However, a specific address hasn't been targeted. Am I correct in thinking that I do not need to delete and create a new email address? I also assume the domain would have been widely blacklisted? Should I move hosting companies and would this make a difference?

Either way, I'll be implementing DKIM.

Sorry for so many questions, I'm just a little lost as the spoofer didn't target a specific email address.


share|improve this question

marked as duplicate by Scott Pack, Dave M, mdpc, Michael Hampton Sep 12 '13 at 21:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

use also SPF, not just DKIM. my guess is that at the moment SPF is more widely checked than DKIM. – pQd Sep 12 '13 at 10:46
Excellent, I will implement both. Thank you :) – Sam Sep 12 '13 at 11:24
up vote 1 down vote accepted

If I understand well, a spammer sent email with a forged from header.

Unfortunately, this is easy to do, but it has no other consequence but annoyance. You have therefore nothing to do except securing your server with SPF and dkim.

You speak about changing the hosting company. There is no need at all, not even for changing the mail address, at least if I understand what happened to you.

share|improve this answer
Thank you Lorenz. I'm just glad that a specific address wasn't used. I'll now be implementing SPF and DKIM. Have a great day :) – Sam Sep 12 '13 at 11:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.