1

I am getting some mails from [email protected] recently which contains the following body

polimer.****@list.ru
    (Generated from tm@polimer**.com)
    SMTP error from remote mail server after end of data:
    host mxs.mail.ru [217.69.139.150]: 550 spam message rejected. Please visit http://help.mail.ru/notspam-support/id?c=492kXe0dKYSNlz4sMg9yCER_-TdG5vEtBgAAAM5DAQAxgVkl or  report details to [email protected]. Error code:
    5DA4DDE384291DED2C3E978D08720F3237F97F442DF1E646. ID:
    00000006000143CE25598131.

In reality I never sent the mail to polimer.****@list.ru and by the looks of it, the mail was sent from plastok@my_domain.com but I don't have any log in my mail server(checked the outbox) about the email being sent to the above referred address.

I have catch all mail enabled in my mail server. My original mails are being sent through Gmail and can also be sent from my domain sever with webmail.

Is it the spoofing? How to identify the sender? If not possible how to stop those mail from sending using my domain name? Please help me to get out this situation.

4
  • 1
    It is fairly trivial to spoof the reply-to and from headers which is where delivery failures will send to - to help prevent this, look into SPF which is a method for whitelisting sources for your mail domain
    – HorusKol
    Commented Mar 30, 2017 at 11:45
  • but with SPF enabled, wouldn't the Hoster get all the Error mails that an incoming mail to their server don't comply with the SPF record? What to do against this?
    – Serverfrog
    Commented Mar 30, 2017 at 14:11
  • @Serverfrog: if your MTA receives an email which it knows is forged, do you think it should it should send a DSN failure back where it claims to come from? (it should drop the email, but not all implementations are equal).
    – symcbean
    Commented Mar 30, 2017 at 14:18
  • @symcbean I think I got this mixed up with DMARC ;)
    – Serverfrog
    Commented Mar 31, 2017 at 7:57

0

You must log in to answer this question.

Browse other questions tagged .