2

I'm just learning about DMARC (DKIM/SPF), so I apologize if my question doesn't make sense.

A few days after I installed a DMARC policy on my server I noticed that the reports from yahoo.com contained thousands of 'validated' sends from my mail server's IP. I also received an email from my VPS host saying that one of the email accounts was compromised. I reset the password on that email account, but a day later I received another report from yahoo.com still showing a thousand valid emails being sent out.

The question I have is...do I need to regenerate a new _domainkey on my server once I've resolved the issues with the 'hacked' account?

Improve this question

3 Answers 3

Reset to default
0

A hacked email account does not automatically implies that your mail server itself has been compromised (in fact, statistically, it does not).

Unless that mail accounts uses credentials that are reused as a real account on the system, the integrity of your server isn't, à priori, compromized.

If you want an analogy, this is like asking if you need to change the locks on your home doors after someone stole your car: unless you left your house keys in the car, you don't have to.

You might, however, want to do an examination of your server logs to see how that account was compromised and check your system's integrity, just in case the attacker got in deeper than you thought.

Improve this answer
4
  • My question really comes down to: Is there something embedded in a valid outgoing email that a spammer can duplicate in a spam email to make the receiving server think it's a valid DKIM signature? Every time I try to run dkim_keys_uninstall and then dkim_keys_install, it generates the same key. If somehow the DKIM KEY can be compromised, I'd like to know if I need to generate a new key.
    – JakeTheSnake
    Sep 17, 2014 at 12:09
  • DKIM uses a public and private key pair. Your mail server is the only place where your private pair is needed and the spammer does not have access to this. When he hacked the mail account, he instructed the server to use the private key but didn't get access to it directly.
    – Stephane
    Sep 17, 2014 at 13:26
  • I'm still getting reports from yahoo's servers that thousands of validated emails are being sent out daily even though I've changed the password for the account.
    – JakeTheSnake
    Sep 17, 2014 at 23:52
  • In that case you might just have setup your server to improperly relay email or installed a vulnerable application (like a badly coded web form). Check your logs and, if necessary, do a network dump to find the source and cause
    – Stephane
    Sep 18, 2014 at 5:25
1

For posterity I'll add my own answer to illustrate the procedure I went through.

Step 1) Discover which accounts are sending spam

  • Log into WHM and go to "Mail Queue Manager". Do searches and view the emails to see which accounts are responsible. If for some reason you don't have access to WHM, chat with your web host to get this information.

Step 2) Change Passwords

  • Log into cPanel and change the login credentials for the affected accounts. Those affected need to be notified over the phone/in person of their new passwords.

Step 3) Remove backlogged spam messages not yet sent

  • Initially I had just changed the email passwords but I kept on receiving notifications of failed deliveries, so I figured "something was still sending emails". Turns out there was a backlog dating back four days with spam messages that had not yet been sent. Return to the Mail Queue Manager and delete the spam messages.

Step 4) Run Antivirus/Anti-Malware Scans

  • Run on all potential entry points...user PCs and the mail server itself.
  • For the mail server, I'm on CentOS so I could install maldetect .
  • For personal PCs/workstations, if you find keyloggers make sure to change the email account's password again after removal of the logger.

Step 5) Keep an eye on the Mail Queue

  • Since the spam mail was generated in huge amounts, watch the mail queue to see if lots of emails are still being generated (this might be difficult if you have a lot of users).

I'd appreciate any additional tips that I may have missed.

Improve this answer
-1

Yes, you should regenerate your DKIM keypair as it may have been compromised. An attack is able to successfully spoof mails from your host. You may also want to setup SPF if the attack is sending mails from a host that doesn't belong to you.

Improve this answer
1
  • I have SPF set up already, but thanks for the info!
    – JakeTheSnake
    Sep 17, 2014 at 0:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .