1

I switched hosts, pointed our domains to the new host, and set up emailboxes on the new host, using the same email addresses as on the old host. Everything works perfectly, and email is sent & received by the emailboxes on the new host. So why does spam — and only spam — continue to flow into the emailboxes on the old host?

This spam does not appear in the emailboxes on the new host, only the old host.

These spammers are not sending to our email addresses in the standard way (which would land them in our emailboxes on the new host). So how are they still finding their way into the old emailboxes, which are no longer linked to our domains?

UPDATE: A friend had a similar experience, and the answer she got was that the spam was being sent from the (old/first) same server, using the DNS on the server, instead of one of the outside world DNS servers. This does make sense to me.

1
  • We'd need to see the headers of the spam mails, and also know your domain name, in order to help with this.
    – Jenny D
    May 11, 2017 at 11:09

1 Answer 1

4

Spammers don't conform to any standards as well as they don't obey any other rules. Spam isn't originated from a well configured and maintained SMTP server. It doesn't care whether it is a legitimate sender for domain used in the From: header or as envelope sender or not, and those two probably doesn't even match etc. etc.

SPAM may come from a hijacked web server or an infected workstation. Even if a spammer is using an own server, the software sending spam is most likely a custom software instead of any MTA normally used.

Therefore it is highly possible and even usual that the program or script sending SPAM won't do standard DNS queries before sending a single message. One reason for that may be just a poor configuration, but sometimes using internal databases instead of DNS may be a way to hide by increasing the time before the infection gets noticed.

After DNS TTL there would be no reason to accept any mail to the moved domains anymore. I'd suggest to remove the domains from the old server's configuration as soon as possible. Also, I don't generally like the idea that mail would arrive on two servers during the TTL, as then users would need to check for their email on two servers and manually move messages arriving during the migration. There are two possibilities for preventing that:

  1. While migrating the mailbox contents, configure the old server to relay email to the new one.
  2. Prior actually changing the DNS records, temporarily lower the TTL and wait for it to expire.

Regarding your update: That would be a really bad situation! It would mean that your old mail server was compromised (or used illegitimately otherwise). Fortunately, it is really easy to rule that out: just see the Received headers and your mail server logs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .