Over the past few days, I've received several spam emails coming from the addresses of a school district. I don't know much about email message headers, but since they contain numerous references like this:

Received: from ecb-mx-out1.example.com (ecb-mx-out1.example.com. [<ip_of_example.com>]) 

that makes me think the address isn't just being spoofed, since it looks like the SMTP server sending out the messages is coming from the school district. I don't know that for sure, however.

If I choose to contact the district's IT department, what information would be helpful for me to provide? Or, since it's clearly possible that the address was merely spoofed, is it just a bother if I contact them and it's more beneficial to them if I just ignore it?

I can post the full message headers if necessary, but I'll probably remove the school district's name/IP address if I do.

2 Answers 2


You've hit the nail on the head - at the very least, provide the full headers from one of the spam emails.

However, I find it most useful when I get a sample of several of the spam emails (say, 3-10, if you have that many) because that allows me to see if the spammers are employing other methods, like changing the message content, subject, or format.

It's usually easiest to create a new email message, then drag and drop the spam emails into it. This adds them as an attachment, complete with headers. (Works in Outlook, Outlook Web, and Thunderbird, and many more I'm sure).

Edit: I forgot to mention; THANK YOU for asking what information would be most useful. The world would be a better place if everyone did that :)

  • 1
    On average, having spam email(s) as an attachment to my email won't trigger a spam filter and get my email marked as spam, right? Mar 21, 2013 at 0:42
  • 2
    @JohnBensin maybe you could send an email first explaining the situation and that you will be sending some examples, then send the message with the attachments. Then even if it is caught by a filter, they will be expecting it and can check the spam.
    – Dave
    Mar 21, 2013 at 1:29

The most common problem is an open relay. If an e-mail server is not properly secured, it will send out messages for any domain and e-mail account that it is asked to send out. The best bet is to contact the organization to make them aware of the issue. If you do a DNS request, they may have a mail administrator specified in their DNS. If not, you can use the WHOIS data to contact them. If that is private as well, then the best bet is probably to find some contact info on their site.

Generally the best bet for what to provide them is to simply give them a copy of the SPAM e-mail. It gives them the most information about what happened and lets them know what is being done in their name. I typically notify an organization even if the e-mail is being spoofed so that they can send a warning to their customers if there is a potential for phishing or damage to their reputation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .