0

A user's account (IMAP, Zimbra server) was hacked (the user doesn't remember/know if he accessed any external links) and there were sent 5k+ emails to external personal accounts. Zimbra mailbox doesn't have any forwarding address. The emails are shown in Exchange (even though the user doesn't have a mailbox there). How is that possible ? We do have Exchange Online for other accounts. Upon troubleshooting, some Zimbra emails appear to be routed through Exchange:

  1. Zimbra Web interface -> known exchange email address -> not visible/routed through exchange
  2. Thunderbird & Pop 3 -> known exchange email address -> not visible/routed through exchange
  3. Telnet tool on the Zimbra server -> known exchange email address -> it is visible/routed through exchange

We believe that Exchange was used as a relay by Zimbra. We'd like to prevent this to happen.

Improve this question

1 Answer 1

Reset to default
1

Relaying while on Exchange Online seem uncertain to me, unless you did connector inside it. It's not on by default.

What can happen is a illegitimate user that send from another location as another user (aka spoofing). Please enforce the SPF and DKIM/DMARC policy as without it anyone on the planet can spoof you organization.

Notable fact; last year Microsoft blocked other tenant to spoof as another tenant domain, as it was a major problem on that platform for spoofing. (as the SPF dont fail that way)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .