0

Since 2 months our email address gets abused by a spam bot. It turns out that emails are send via our info@ email address to thousands of recipients of which many mails bounce back and land back in our inbox.

Our domain is hosted at the German provider 1und1. I use route 53 nameservers in order to resolve the domain on heroku.

Here is my mail relevant setup at route 53:

MX Servers configured:

10 mx01.kundenserver.de
20 mx00.kundenserver.de

SPF Record:

"v=spf1 a mx ~all"

TXT Record:

"QH+******************"

After the first spam attempt I have setup the SPF record hoping this would solve the problem but it did not. Also according to SES statistics, it looks like the emails are not send via SES so I can also guarantee that our website is working correctly and mails are not send via the website.

It must be some other clinch which I don't know about.

How can it be that a spam bot is abusing our own email to send out spam? How can I prevent Spam mailings in the future?

Thanks for any help.


Header of one of the bounced spam emails:

--===143084232====mail.ip.ncnet.ru=== Content-Type: text/plain; charset="utf-8"

Failed to deliver to '[xxxxxxx]@platicly.com' SMTP module(domain @77.37.254.238|platicly.com) reports: platicly.com: DNS transaction timeout

--===143084232====mail.ip.ncnet.ru=== Content-Type: message/delivery-status

Reporting-MTA: dns; mail.ip.ncnet.ru

Original-Recipient: rfc822;<[xxxxxxx]@platicly.com> Final-Recipient: rfc822;<[xxxxxxx]@platicly.com> Action: failed Status: 4.0.0

--===143084232====mail.ip.ncnet.ru=== Content-Type: text/rfc822-headers

Received: from [103.194.195.11] (account holiday_@ints.ru HELO ycwep.com) by mail.ip.ncnet.ru (CommuniGate Pro SMTP 5.2.12) with ESMTPSA id 142886298; Fri, 03 Jun 2016 13:55:17 +0400 From: To: "EHarmonyPartner" <[xxxxxxx]@live-bits.com>, "EHarmonyPartner" <[xxxxxxx]@octport.com>, "EHarmonyPartner"
<[xxxxxxx]@platicly.com>, "EHarmonyPartner"
<[xxxxxxx]@punkpiratesrombooks.com>, "EHarmonyPartner"
<[xxxxxxx]@rapidecho.com> Subject: nice story Date: Fri, 3 Jun 2016 12:28:46 +0300 Message-ID: <00008d5d4f67$73c20ef1$bd5cd982$@braufabrik.de> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_7EFA7AF8.4214CADC" X-Mailer: Microsoft Outlook 15.0 Thread-Index: AdHD4OenOcoMJM/OvRLBDcH+5LF7TA== Content-Language: en-us

--===143084232====mail.ip.ncnet.ru===--

  • Did you find a solution for that? I am at 1&1 in Germany, too, and my eMail was abused by this exact bot yesterday. I found out, when the first torrent of Maildelivery Failures came in, changed my password and then just one more torrent came in. Not everyone from my address list received an email, so it seems, I was able to stop it for the moment, but I don't know at all what to do, if it returns. Thanks – user368946 Aug 4 '16 at 23:32
1

The email probably isn't going via your infrastructure, they're just using your domain as the "from" address. Changing your infrastructure generally has no effect as it's not coming from you. Changing server, email, or DNS providers won't help. All you can do is use anti-spoofing techniques, SPF and DKIM.

Your SPF record is malformed, you need to specify the MTA that's authorised to send email. Read up on it. Change your SPF qualifier from ~ (soft fail, ie do nothing) to - (fail). Use this or this to create your SPF records.

Set up DKIM. This prevents email spoofing, ie people sending email that claims to be from you, but isn't. This is similar to SPF in some ways, but doing both is best - not all receiving MTAs will validate both SPF and DKIM.

-2

You can prevent such problems by setting up Transport Layer Security for Outbound Mail. If you do that, you will also have to enable TLS on the clients sending (like Outlook).

  • I'm not convinced that this is correct. What is the problem you believe this solves, and why is it a solution? These messages may not be traversing OP's infrastructure at all -- forged headers won spam can easily result in backsplatter to the domain that appears to have sent the message, and there's very little that can be done about that. – Michael - sqlbot Jun 6 '16 at 11:10
  • Maybe I need to move my domain to another registrar for which I don't need to use amazon name-servers (I mainly do this because 1und1 does not support CNAME entries). Could that work? – DonMB Jun 6 '16 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.