7

We have an email id, info@<ourdomain>.com This email id is being hacked frequently and mails are sent from this email id, Following is the example of one such email.

From: info@<ourdomain>.com [mailto:info@<ourdomain>.com]
Sent: 20 October 2014 03:00
To: info@<ourdomain>.com
Subject: Starten Sie Ihre Karriere mit unserem Unternehmen!

Wir begrüssen Sie und möchten ihnen die Zusammenarbeit mit unserem Team anzubieten und erzählen über unsere Arbeitsbedingungen.

Erstens sollen Sie keine Beitrage einrichten um bei uns zu arbeiten.


Das ist eine gute Gelegenheit für die Rentner, Frauen im Schwangerschaftsurlaub,oder für diejenigen, die von den Stressen, 
der Hektik und der Konkurrenz loskommen möchten,
oder für diejenigen, die eine Möglichkeit suchen, Teilzeit zu arbeiten und zusätzliches Geld zu verdienen.
Sie können ihre Arbeitszeit von 2 bis 8 Uhr variieren.

Ihr Gehalt beträgt 3500 Euro und Bonus.( Es hängt von den Arbeitsstunden ab)

Wir arbeiten von Montag bis Freitag von 09.00 Uhr bis 18.00 Uhr.

Für weitere Information schreiben Sie bitte uns per E-MAil:[email protected].

Translation given by Google Translate is,

Subject: Start your career with our company! 

We welcome you and want to offer them the cooperation with our team and tell about our working conditions.

First, you should set up no contributions to work with us.

This is a good opportunity for the pensioners, women on maternity leave, 
or for those who want to get away from the stressing, the bustle and competition,
or for those looking for a way to work part time and earn extra money. 
You can vary their working hours 2-8 clock.


Your salary is 3500 euros and bonus. (It depends on the working hours from) 

We work from Monday to Friday from 09.00 bis 18.00 clock clock. 

For more information please send us an e-MAil: [email protected].

How to stop these kind of frauds? How to secure our email ids from these kind of fraudsters. We have hosted our website in justhost

Update

Following is the raw email header,

Return-Path: <info@<ourdomain>.com>
Envelope-to: info@<ourdomain>.com
Delivery-date: Sun, 19 Oct 2014 14:07:51 -0600
Received: from [78.41.168.158] (port=28228 helo=rev-78-41-168-158.radiolan.sk) by just68.justhost.com with esmtp (Exim 4.82) (envelope-from <info@<ourdomain>.com>) id 1XfwlZ-0001B6-Re for info@<ourdomain>.com; Sun, 19 Oct 2014 14:07:51 -0600
Message-ID: <7B28D9A1FC8A5084D7265E0375AF7B28@KJAK166XR7>
From: <info@<ourdomain>.com>
To: <info@<ourdomain>.com>

Subject: Starten Sie Ihre Karriere mit unserem Unternehmen!

Date: 19 Oct 2014 22:29:44 +0100
X-SpamFlt-Status: Not Detected
X-KASFlt-Status: Status: trusted
X-KASFlt-Status: Rate: 0
X-KASFlt-Status: Lua profiles 67777 [Oct 15 2014]
X-KASFlt-Status: Method: white email list
X-KASFlt-Status: {received from trusted sender <info@<ourdomain>.com>: white list}
X-KASFlt-Status: {RECEIVED: dynamic ip detected}
X-KASFlt-Status: Version: 5.2.1
X-KASFlt-Status: {Bot: susp-dmspammer}
MIME-Version: 1.0
X-SpamFlt-Phishing: Not Detected
Content-Type: multipart/alternative;
                boundary="----=_NextPart_000_01A0_01CFEC48.7E068270"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.1.7600.16807
X-Identified-User: {0000:just68.justhost.com:local:local} {sentby:Delivered locally}

Update 2:

Because of lot of spam mails sent from our email id, info@<ourdomain>.com, our email ids from this domain and our domain gets blacklisted. How to stop this?

2
  • 13
    Your e-mail id is not hacked. It's like sending a package to someone with an Amazon sticker and logo on it. With a good printer, given enough skill, you can fake (or spoof) such a packing envelope or box. This is the same kind of game, so nothing is hacked - it is spoofed!
    – SPRBRN
    Oct 20, 2014 at 8:18
  • 6
    Notice that the German by itself looks autotranslated :-)
    – Bergi
    Oct 20, 2014 at 11:38

1 Answer 1

11

This is because SMTP does not offer great spoofing protection, so typically you can connect to a server and claim to be someone else. The best way to fix this would be to set up an SPF record with a hard fail, which is expressed using a- and typically is at the end of the record as -all. You would have to be certain of where your emails are coming from. You can use other domain names or IP addresses for this. Below is an example of the TXT record you'd need for SPF. There are many how-tos available. If you are concerned legitimate messages will be dropped, you could also enable DMARC reports before actually turning on a hard fail, and instead using the soft fail which is expressed as ~.

example.com. IN TXT "v=spf1 ip4:192.0.2.0/24 ip4:198.51.100.123 a -all"
1
  • 1
    There is also DMARC, BTW.
    – Uwe Keim
    Oct 20, 2014 at 13:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .