3

I have recently been receiving spam that has been listed as my own email address. I remember doing a few telenet emails back in school and know there are some ways to send looking like they are coming from a different place but wanted to ask others opinions on this. The server is a Zimbra 6.06 server running on Debian lenny. Does anyone think there is possibly something wrong with the setup here or is this just some spoofing going on? I can see that the email is coming from outside of the network of course. 

Return-Path: 0-ka@ps.ge.com
Received: from zimbra.example.com (LHLO zimbra.example.com) (10.0.0.1) by
 zimbra.example.com with LMTP; Tue, 10 May 2011 06:00:40 -0500 (CDT)
Received: from localhost (localhost [127.0.0.1])
    by zimbra.example.com (Postfix) with ESMTP id D2B9759FC5
    for <grant@example.com>; Tue, 10 May 2011 06:00:40 -0500 (CDT)
X-Virus-Scanned: amavisd-new at zimbra.example.com
X-Spam-Flag: YES
X-Spam-Score: 8.593
X-Spam-Level: ********
X-Spam-Status: Yes, score=8.593 tagged_above=-10 required=6.6
    tests=[BAYES_99=3.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_XBL=3.033,
    RDNS_NONE=0.1] autolearn=no
Received: from zimbra.example.com ([127.0.0.1])
    by localhost (zimbra.example.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 5Be4Ob1KSuhu for <grant@example.com>;
    Tue, 10 May 2011 06:00:39 -0500 (CDT)
Received: from [81.211.11.134] (unknown [81.211.11.134])
    by zimbra.example.com (Postfix) with ESMTP id 44CBC59D4F
    for <grant@example.com>; Tue, 10 May 2011 06:00:39 -0500 (CDT)
Received: from 81.211.11.134(helo=example.com)
    by example.com with esmtpa (Exim 4.69)
    (envelope-from )
    id 1MMKY8-2034hf-28
Improve this question
1
  • I use Postini as my anti-spam gateway and have rules to drop any mail received from mydomains.com as anything internal would never see the outside.
    – gravyface
    May 10, 2011 at 13:16

2 Answers 2

Reset to default
6

Having a properly configured SPF record can alleviate a little bit of that pain.

It will prevent someone from sending email claiming it is from your domain.

Improve this answer
2
  • 1
    Well, it will if in addition to publishing a well-configured SPF record you also configure your MTA to check SPF records on incoming email. But I agree, this is well-worth doing.
    – MadHatter
    May 10, 2011 at 13:15
  • I followed the instructions here for SPF, pyzor, and razor and am still seeing some spoofing going on. I do not see anything indicating that my MTA should check the SFP records. Anyone know how to force that on zimbra? wiki.zimbra.com/…
    – grantk
    May 10, 2011 at 17:25
1

You can write anything in the "From" header field of an email. Try it with standard mail command on any Linux box:

$ mail -a "From: rms@gnu.org" -s "Richard Stallman here!" <your_email_address>
Improve this answer
2
  • heh, I did not know he knew my email address! I was just curios as to whether or not there was anything I was possibly doing wrong on the server side. But I assume not, although I am curious how they got the emails, spoofed an awful lot of them, as well as some alias used internally mostly, but if this one was answered that would probably be a very rich man then.
    – grantk
    May 10, 2011 at 13:12
  • They don't need to know your email address. Normally they will try ten of thousands of possible combinations (or maybe much more), most of which will not get delivered, but a handful of them will be valid addresses and so do get delivered. Unless you have a catchall address, you must likely don't know anything about all the others.
    – sgmoore
    May 10, 2011 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.