1

I am getting some mails from Mailer-Daemon@s09.webhost1.ru recently which contains the following body

polimer.****@list.ru
    (Generated from tm@polimer**.com)
    SMTP error from remote mail server after end of data:
    host mxs.mail.ru [217.69.139.150]: 550 spam message rejected. Please visit http://help.mail.ru/notspam-support/id?c=492kXe0dKYSNlz4sMg9yCER_-TdG5vEtBgAAAM5DAQAxgVkl or  report details to abuse@corp.mail.ru. Error code:
    5DA4DDE384291DED2C3E978D08720F3237F97F442DF1E646. ID:
    00000006000143CE25598131.

In reality I never sent the mail to polimer.****@list.ru and by the looks of it, the mail was sent from plastok@my_domain.com but I don't have any log in my mail server(checked the outbox) about the email being sent to the above referred address.

I have catch all mail enabled in my mail server. My original mails are being sent through Gmail and can also be sent from my domain sever with webmail.

Is it the spoofing? How to identify the sender? If not possible how to stop those mail from sending using my domain name? Please help me to get out this situation.

Improve this question
4
  • 1
    It is fairly trivial to spoof the reply-to and from headers which is where delivery failures will send to - to help prevent this, look into SPF which is a method for whitelisting sources for your mail domain – HorusKol Mar 30 '17 at 11:45
  • but with SPF enabled, wouldn't the Hoster get all the Error mails that an incoming mail to their server don't comply with the SPF record? What to do against this? – Serverfrog Mar 30 '17 at 14:11
  • @Serverfrog: if your MTA receives an email which it knows is forged, do you think it should it should send a DSN failure back where it claims to come from? (it should drop the email, but not all implementations are equal). – symcbean Mar 30 '17 at 14:18
  • @symcbean I think I got this mixed up with DMARC ;) – Serverfrog Mar 31 '17 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.