1

The clients on my VPS are all getting spammed. The spam seemingly comes from their own email addresses - it is clear that somehow something got into my VPS and was able to capture all the email addresses that existed and is now using them to send spam.

I was advised to set up a SPF record, but I am unsure what this is or how to go about it.

After reading, I have figured out how to create one in CPanel, but I cannot find what to do with it now. Do I copy it into somewhere in my DNS records in Zone Management? Can anyone point me in the right direction?

1 Answer 1

1

Just because mailboxes hosted on your VPS are sending out spam, it does not mean that your server was compromised. A script may have maliciously accessed their email credentials from anywhere and is now subsequently able to access as and when they like to distribute thousands of spam emails to huge email lists (or, most likely to everyone in that mailboxes contacts/address book) Here is a similar scenario of this happening.

The best way to diagnose this would be to change the password to the particular mailbox sending the spam and don't advise the end user of the password straight away. Then see if the sending of spam from that mailbox halts (by analysing the mail logs on the VPS and monitoring the mail queue).

If literally, everyone on your VPS is affected, then I'd analyse your access logs to see exactly where the access is coming from and how they're accessing (you may have to dive into multiple logs to identify this).

If their emails are being spoofed (it doesn't sound like it though if they appear to come from themselves), then this may be useful.

If you did want to create an SPF record though, you have to set this up as a TXT record in the DNS zones. What the TXT record contains is entirely down to your VPS setup though but you can use an online generator such as this one.

2
  • Thanks for the detailed info! Just a quick one: my Domain name Registrar offers a TXT input field and an SPF input field. Should I paste site.com. IN TXT "v=spf1 ip4:122.100.2.1 -all" in both?
    – MeltingDog
    Nov 1, 2013 at 0:35
  • Adding DNS records at your domain registrar will only apply to anything on your VPS if you've actually assigned the registrar to handle the DNS for your VPS (normally by using the registrars own nameservers and not your VPS's). In most cases, the DNS zones would be managed on the VPS itself (but this depends on your setup). Best to check with their own documentation - I would imagine you'd only need to enter the record in the SPF input though.
    – zigojacko
    Nov 1, 2013 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.