Can someone please explain to me how its possible that someone hacks a server and uses its email to send emails from a address thats not listed on the server and how to prevent it.

When I look at the mail queue there are emails there from and to yahoo.com accounts, how does this happen and how can I prevent this. Running centos 6, interworx and qmail if that helps.


This is the nature of how email works, unfortunately.

There is nothing preventing you or I from sending an email from any address we choose, this is by design. What we can tell though is the IP address the email originated from in the mail headers, and this will give us an idea of where the original message came from.

In the old internet, most mail servers were run as open relays. This means that to send an email from yahoo.com to google.com, you could use any open relay you found on the internet. If the IP got banned, its okay because it isn't your IP, and you could just change relays.

Now, with most modern mail servers, this isn't really an option. SMTP servers will only relay a message if you are authenticated, preventing random internet users from abusing your services. The server would accept unauthenticated mail only for users on that particular mail server.

Due to this change, spammers now need to completely compromise mail servers in order to abuse them.

If an attacker compromises your server, there isn't much you can do to stop them from sending emails short of blocking outbound port 25 on the firewall. If you need to run a legitimate mail server, then this becomes a problem as you would be denying legit email from being sent.

Also, I would check your IP against any blacklists. It may have ended up on some lists and you would then need to submit a delist request, including how you resolved the issue.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.