3

I do have a really weird one. I am running a webhosting server that is being blocked by certain providers that use Cloudmark. I contacted the customer support and they got back with an email header that is unfortunately sending spam.

Received: from sub.domain.example ([1.1.1.1(my servers ip)])
Subject: sven.n.nilsson,=?utf-8?q?=62=65=6b=72=c3=a4=66=74=61=20=64=69=74=74=20=64=65=6c=74=61=67=61=6e=64=65=2e=2e=21=21=21?=
From: =?utf-8?q?=53=77=65=64=69=73=68=20=6d=65=74=68=6f=64?=  <VNH9DI6HOW68YGD4AWRMSPB0VT7UWSHX5@gmail.com>

The header states, that the mail came from my server. But how is that possible, I do have a closed relay and there is no mailbox for that domain. Furthermore, the domain is pointing to my servers' IP. How can I prevent it from faking email headers and pointing to my servers' IP?

  • You say a webhosting server. Are the only accounts on the server yours? – Steve Dec 8 '19 at 1:45
  • 1
    Check the files on your server, maybe someone uploaded a file that is allowing attackers to send emails from your server. Also you should be able to prevent it by setting correct SPF records on your domain – NatWeb Solutions Dec 8 '19 at 5:29
  • Thanks. Will check that. – Andreas Schantl Dec 8 '19 at 19:04
  • And yes. It's only my accounts. But I'll definitely have look at the files if I can find anything suspicious – Andreas Schantl Dec 8 '19 at 19:05
1

First of all,

You would have a security breach, so please check your server or hosting account for security-related problems and then to mitigate the sending of spam emails (spoofed) from that domain(subdomain) create a TXT record (DNS) with the following.

sub.domain.example TXT "v=spf1 -all"

By doing this you're telling the whole internet that this subdomain is not intended to send mail, please do this even if you don't have a mailbox in your server.

| improve this answer | |
  • How do you know it is a security breach? – Steve Aug 25 at 6:45
  • He stated that the header of the sending email was coming from his server ip. – Santiago Aug 25 at 12:22
  • That doesn't necessarily mean a "security breach" unless you mean it in the most broad of terms. – Steve Aug 25 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.