0

I'm facing an issue whereas one of my users is receiving an email which is sent by his own address containing a javascript zipped file which obviously is malicious. I have tried to look in the logs but I cannot find any reference to this message. How can I understand where this message is originating from? All the records for this user have an IP which is private so I suppose he is using clients from his own networks.

Example:

[email protected] H=([10.141.53.117]) [197.250.193.117] P=esmtpsa X=TLS1.0:ECDHE_RSA_AES_256_CBC_SHA384:256 A=plain_saslauthd_server:user S=9555 [email protected]

I have clamav and spamassassin installed which are regularly working and updated but for some reason they are not intercepting this message.

Improve this question
1
  • 2
    What are the headers of the message?
    – Michael Hampton
    Mar 17, 2016 at 5:10

1 Answer 1

Reset to default
2

Sometimes the From header is spoofed. Look at the messages headers (Received: is usually the most useful). I would suggest adding dkim and spf records to your domain so only your mail servers can send mail from your domain.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .