Just examined a spam email sent to me. The header's "originator" has both my email address and my web site's IP address, (my SMTP). My first thought is that someone has obtained my email password since I'm sure that my site's sendmail is secure. Is there some way that this could be a spoof, or what?
2 Answers
Originating email address is quite easy to spoof when SPF is not in the picture. However, given the nature of TCP it's much harder to spoof a source IP address. It is possible your account is compromised if you are seeing this source IP. I would highly recommend changing your password. There is a possibility there is something configured incorrectly with Sendmail, however, that might allow messages to be forged or relayed through you. I am not a Sendmail expert but I know it's notoriously hard to secure properly.
answered Nov 9, 2014 at 20:58
YES it is possible that it is forged. Only the very last envelope/stamp/header is to be believed. Anything below/before that can be forged and you do not know the providence from which it came! When you get a piece of mail, you know the IP of the system you are talking to, and you trust your mail system, so you know that envelope/header/stamp is correct. However, they could have received a forged email, or they could be the source of the forgery, or they could just be an open relay. You can not know. It could be possible that someone forged your email, but it could also be possible they are specifically targeting you seeking to break into your system by freaking you out, forcing you to log in, and hopefully capture your password. Still, it would be good to investigate, update, scan, change passwords, etc. Just be careful.
Here is an online tool to test your mail server http://www.dnsstuff.com/tools (Click the Email tab). (Also found this: https://www.wormly.com/test_smtp_server)
Here is the documentation for Postfix for relay and access control. http://www.postfix.org/SMTPD_ACCESS_README.html
