I do have a really weird one. I am running a webhosting server that is being blocked by certain providers that use Cloudmark. I contacted the customer support and they got back with an email header that is unfortunately sending spam.
Received: from sub.domain.example ([18.104.22.168(my servers ip)]) Subject: sven.n.nilsson,=?utf-8?q?=62=65=6b=72=c3=a4=66=74=61=20=64=69=74=74=20=64=65=6c=74=61=67=61=6e=64=65=2e=2e=21=21=21?= From: =?utf-8?q?=53=77=65=64=69=73=68=20=6d=65=74=68=6f=64?= <VNH9DI6HOW68YGD4AWRMSPB0VT7UWSHX5@gmail.com>
The header states, that the mail came from my server. But how is that possible, I do have a closed relay and there is no mailbox for that domain. Furthermore, the domain is pointing to my servers' IP. How can I prevent it from faking email headers and pointing to my servers' IP?