3

I do have a really weird one. I am running a webhosting server that is being blocked by certain providers that use Cloudmark. I contacted the customer support and they got back with an email header that is unfortunately sending spam.

Received: from sub.domain.example ([1.1.1.1(my servers ip)])
Subject: sven.n.nilsson,=?utf-8?q?=62=65=6b=72=c3=a4=66=74=61=20=64=69=74=74=20=64=65=6c=74=61=67=61=6e=64=65=2e=2e=21=21=21?=
From: =?utf-8?q?=53=77=65=64=69=73=68=20=6d=65=74=68=6f=64?=  <[email protected]>

The header states, that the mail came from my server. But how is that possible, I do have a closed relay and there is no mailbox for that domain. Furthermore, the domain is pointing to my servers' IP. How can I prevent it from faking email headers and pointing to my servers' IP?

4
  • You say a webhosting server. Are the only accounts on the server yours?
    – Steve
    Commented Dec 8, 2019 at 1:45
  • 1
    Check the files on your server, maybe someone uploaded a file that is allowing attackers to send emails from your server. Also you should be able to prevent it by setting correct SPF records on your domain Commented Dec 8, 2019 at 5:29
  • Thanks. Will check that. Commented Dec 8, 2019 at 19:04
  • And yes. It's only my accounts. But I'll definitely have look at the files if I can find anything suspicious Commented Dec 8, 2019 at 19:05

1 Answer 1

1

First of all,

You would have a security breach, so please check your server or hosting account for security-related problems and then to mitigate the sending of spam emails (spoofed) from that domain(subdomain) create a TXT record (DNS) with the following.

sub.domain.example TXT "v=spf1 -all"

By doing this you're telling the whole internet that this subdomain is not intended to send mail, please do this even if you don't have a mailbox in your server.

3
  • How do you know it is a security breach?
    – Steve
    Commented Aug 25, 2020 at 6:45
  • He stated that the header of the sending email was coming from his server ip.
    – Santiago
    Commented Aug 25, 2020 at 12:22
  • That doesn't necessarily mean a "security breach" unless you mean it in the most broad of terms.
    – Steve
    Commented Aug 25, 2020 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.