Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This might have something to do with a server that I have set the root user with a forward rule to send me emails. But I am not sure and I can't figure out why... Is it possible that my server has been used by other people to do spamming? My server is in a local network by the way.

Based on the returned content of the email, it's for several spam emails. Pure spam. And the sender is not even ME, not even a proper address (some random name). That's why I think it feels like someone seems relaying emails (spam) through my server. And I got all the returned emails back. My email server (a very good company) didn't treat this as spam. They normally help me block tons of spam automatically.

For example

The original message was received at Sun, 26 Jan 2014 05:05:40 -0700
from []

   ----- The following addresses had permanent fatal errors -----
    (reason: 550-5.1.1 The email account that you tried to reach does not exist. Please try)

   ----- Transcript of session follows -----
... while talking to
>>> DATA
<<< 550-5.1.1 The email account that you tried to reach does not exist. Please try
<<< 550-5.1.1 double-checking the recipient's email address for typos or
<<< 550-5.1.1 unnecessary spaces. Learn more at
<<< 550 5.1.1 ha7si10821727icc.12 - gsmtp
550 5.1.1 <>... User unknown
<<< 503 5.5.1 RCPT first. ha7si10821727icc.12 - gsmtp

priearl2003 is the spammer I think.

Content-Type: Message/delivery-status
Content-Description: Delivery error report

Final-Recipient: rfc822;
Action: failed
Status: 5.0.0
Diagnostic-Code: SMTP; SMTP error, DOT: 550 5.7.0 (SNT0-MC4-F26) Message could not be delivered. Please ensure the message is RFC 5322 compliant..(SMTP&nbsp;error,&nbsp;DOT:&nbsp;550&nbsp;5.7.0&nbsp;(SNT0-MC4-F26)&nbsp;Message&nbsp;could&nbsp;not&nbsp;be&nbsp;delivered.&nbsp;Please&nbsp;ensure&nbsp;the&nbsp;message&nbsp;is&nbsp;RFC&nbsp;5322&nbsp;compliant.)
Content-Type: Message/Rfc822
Content-Description: Undelivered Message
Content-Transfer-Encoding: 8bit

Received: from mycomputer (unknown [])
    by smtp4 (Coremail) with SMTP id DtGowECZB0Ue6ORSchJSDQ--.24287S3;
    Sun, 26 Jan 2014 18:49:20 +0800 (CST)
From: "markp markp" <priearl2003>
To: "keacyking" <>, "KC" <>,
 "sexy kio kyle hot7187493825" <>,
 "rod isreal" <>,
 "korey 3369724167" <>,
 "junglefever 04" <>, "Keino" <>,
 "Y U WANNA KNOW autour detroit" <>,
 "Kennen butler buffalo" <>,
 "=?ISO-8859-1?Q?Charles_Knowles=2C_Jr?=" <>
Subject: markp markp
Date: Sat, 26 Jan 2014 11:49:14 +0100
MIME-Version: 1.0
X-mailer: Microsoft Office Outlook, Build 11.0.5510
Reply-To: priearl2003
Content-type: Multipart/mixed; boundary="3E762EB7_62CA3E41_boundary"
Content-Description: Multipart message
X-Coremail-Antispam: 1Uf129KBjDUn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7v73
X-Originating-IP: []

Content-type: text/html; charset=UTF-8
Content-Transfer-Encoding: Quoted-printable
Content-Disposition: inline
Content-Description: HTML text

=EF=BB=BF<html><head><meta http-equiv=3D"content-type" content: text/html;=
share|improve this question
Could simply be "backscatter". Someone used you as their "From" address and your getting the junk back. Without more details, difficult to tell. – Marki Jan 26 '14 at 12:23
I'll try to post some more details. – Hao Jan 26 '14 at 12:25

Based on the information you've provided, this is almost certainly not coming from your server unless you run an open relay. The message originated in China:

inetnum: -
netname:        UNICOM-BJ
descr:          China Unicom Beijing province network
descr:          China Unicom
country:        CN
admin-c:        CH1302-AP
tech-c:         SY21-AP
mnt-by:         APNIC-HM
mnt-lower:      MAINT-CNCGROUP-BJ
mnt-routes:     MAINT-CNCGROUP-RR
mnt-irt:        IRT-CU-CN
status:         ALLOCATED PORTABLE

(I got this information from APNIC, after checking ARIN first.)

The most common reason for you to get those emails is that spammers have spoofed your domain ("backscatter," as Marki said). There's not a whole lot you can do about that, but, on the up side, it's unlikely to get you on blocklists, either.

Edit in response to your edit: The second IP listed is from the Ukraine. You can find that number in RIPE.

I suspect that what you're looking at is backscatter from a spambot network that spoofed an address in your domain.

share|improve this answer

Could simply be "backscatter". Someone used you as their "From" address and you're getting the junk back.

There is no 100% solution to protect against this. You could e.g. set up SPF entries (in your DNS) and the like. But this will only have an effect with (recipient) mail servers that also interpret that information. I would bet the big ones do (like here Google).

In essence this give people the information which servers mail from @yourdomain should be coming from and not accept it otherwise. All this is unfortunately an effect of the inherent insecurity in the SMTP protocol.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.