Solved

Somebody sent spam using one of my users accounts

Posted on 2008-06-24
2
207 Views
Last Modified: 2010-04-21
I have a simple one domain, one exchange server (2003) system.  One of my 70 users came in the other day to find 500 undeliverable messages in her Outlook.  They were all spam using her account.I checked MXLOOKUP and we do not have an open relay.  There are only a few messages in my System Manager queue.  This is a one-time occurrence.  Should I ignore it and see if it repeats?  Or what should I check to prevent a reoccurrence.  Our incoming mail goes through a spam filter, but I don't believe our outgoing mail does.
0
Comment
Question by:tomcurrier
2 Comments
 
LVL 70

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 21863821

Not an uncommon situation unfortunately.

It's likely that the spam didn't originate at your servers at all. Spoofing SMTP addresses is utterly trivial so pretty much anyone can pick up an address and use it as they wish.

You don't get a great deal of choice about what you do with this. Your only option to help reduce the impact should it occur again is to add an SPF (Sender Policy Framework) record for your domain (a TXT Record on your public DNS Server).

The SPF Record allows you to explicitly declare which IP addresses are permitted to send mail for your domain name. It's an extremely useful mechanism for reducing abuse as you've seen above.

The tricky bit is that it is impossible to completely stop abuse like this, SMTP is inherently insecure. Things like SPF sit on top of (or in front of) SMTP and attempt to add a level of security. Not everyone checks SPF Records though. Those that don't will still return NDRs without further consideration. And not all ISPs allow you to add them, an annoying situation.

For instructions (and wizards) for generating SPF Records you can use either this site (this one also contains full details of the syntax):

http://www.openspf.org/

Or this one:

http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/

If you've created yourself a record and aren't sure at all please don't hesitate to post back.

HTH

Chris
0
 

Author Closing Comment

by:tomcurrier
ID: 31470365
Chris, many thanks.  That helps
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Office 365 Public IP configuration on DNS ? 7 52
Hybrid Exchange dual mailbox issue 3 36
exchane, activesync 4 21
Exchange 2010 DAG Replay Queue 9 29
Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
How to resolve IMCEAEX NDRs in Exchange or Exchange Online related to invalid X500 addresses.
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question