I noticed yesterday that I had received spam e-mail, but my own e-mail address was listed as the sender. Naturally, I changed my password. This is probably a spoof, but I don't know enough about SMTP to understand the e-mail's headers and be sure of it.

I have two questions:

  • Was my e-mail account compromised?
  • Why would a spammer send mail to me that lists myself as the sender?
  • 4
    Getting spam from "yourself" is pretty common. They likely spoofed your address as the sender.
    – schroeder
    Commented Nov 5, 2015 at 22:46
  • That's weird. I've been using this e-mail address for four years, and I've never gotten spam from "myself" until this week.
    – JesseTG
    Commented Nov 5, 2015 at 22:55
  • 1
    in the mail source you can se the real sender, info displayed can be faked
    – Froggiz
    Commented Nov 5, 2015 at 23:05
  • There was no need for you to change your account password. This was just your address which was used, and everyone can do this easily :).
    – dan
    Commented Jan 14, 2016 at 23:21

3 Answers 3


SMTP messages have a host of header values that are used by mail servers (Qmail) and mail clients (Outlook, Gmail) for different things. It's possible your email was set as either the From or the Sender value which was displayed by your mail client.

Here's some info on SMTP from and sender headers: https://www.rfc-editor.org/rfc/rfc4021#section-2.1.2

As for your questions...

Question 1: No idea. Getting emails from yourself isn't a guarantee that your account was compromised.

Question 2: If I were a spammer I would look for ways to confuse digital and organic anti-spam systems. You could imagine anti-spam filters that automatically whitelist emails that come from the account holder and you can imagine people that get curious about messages that look like they came from themselves. Those types of messages might be more likely to slip past spam filters and get clicked.

If you want to know more about the message you can investigate the mail headers. That will show you the sender, the from, the return-path. You should also be able to see what server your mail server received the message from so that might be a clue.

You could also look in your Sent mail folder. If someone did compromise your account and send you mail and forgot to hide their tracks, you might see a copy of the message in there. If you do find a copy in your Sent folder, that's a pretty strong indicator that something is wrong...


You didn't specify, so I assumed it was a bounce message. If so, there are two possible options here:

a) The spammer sent spam using your address as the reply-to. This is called Backscatter, and it's pretty common.

b) The email is actually spam, disguised as a bounce message. People are more likely to open bounce messages than they are undisguised spam, so this technique is sometimes used. This is called Deliberate Bounce.

This topic is dealt with more deeply here: https://blog.malwarebytes.org/online-security/2015/11/backscatter-or-misdirected-bounces/


To reduce these backscatter email messages, look at the SPF record for your domain


You can change the SPF policy to -all where the minus sign means enforce all receiving MTAs to only accept email from non-spoofed addresses.

You can go a step further and add DKIM signing with a DMARC policy to prevent this from occurring.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .