?
Solved

External user sending email On Behalf Of internal user

Posted on 2009-04-20
7
Medium Priority
?
655 Views
Last Modified: 2012-05-06
I'm a bit puzzled at how this is happening:

We have an external customer who is sending email FROM their email address, On Behalf of one of our internal email addresses. So, For example, let's say "Nick" is the external customer, "Todd" is internal employee, and "Greg" is an internal employee. Nick@external.com sent an email to Greg@internal.com On Behalf Of Todd@internal.com.

How in the world can Nick (Being an external customer) send email to a 3rd person, on behalf of one of our internal users???

I double checked the security tab in AD for our internal users and nothing seems out of place. We can only select from our GAL in Outlook for delegation, so I don't think the user was able to grant Nick send on Behalf permission.

Any thoughts?
0
Comment
Question by:WPI Help
  • 4
  • 2
7 Comments
 
LVL 1

Expert Comment

by:anhnt184
ID: 24188721
It is impossible. You can not do that except External domain and internal domain are trusted.
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24188871
Nothing to do with permissions.
This can be easily done by false SMTP headers which are interpreted by Outlook as Send on Behalf of.
When it comes to email from outside you cannot trust the From headers. You can put anything you like in to them, as spammers well know.

Simon.
0
 

Author Comment

by:WPI Help
ID: 24188922
Right. That's my thoughts, but somehow this external user is sending email
From: Nick [Nick@external.com] On Behalf Of Todd@internal.com

On the incoming message header, it shows:
From: <Todd@internal.com>
Sender: "Nick" <nick@external.com>
To: <greg@internal.com>
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
LVL 65

Accepted Solution

by:
Mestha earned 1000 total points
ID: 24189226
So?
You can do that yourself.
Telnet to your server and do a regular Telnet test.
After you have put the DATA part in, enter

From: email@address

Putting another email address in there.
It will appear as on behalf of.

Simon.
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24189229
I could send you an email that says From Steve Jobs on Behalf of Bill Gates if you like!

Simon.
0
 

Author Comment

by:WPI Help
ID: 24194330
I understand how spoofing works, I just find it REALLY hard to believe that a VP of construction is messing with SMTP headers.
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24195643
I was explaining how it could be done. However that isn't to say that whatever email client is being used at the other end will create an email message that does the same thing.

Simon.
0

Featured Post

Veeam and MySQL: How to Perform Backup & Recovery

MySQL and the MariaDB variant are among the most used databases in Linux environments, and many critical applications support their data on them. Watch this recorded webinar to find out how Veeam Backup & Replication allows you to get consistent backups of MySQL databases.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article lists the top 5 trialware OST to PST Converter Tools. These tools save a lot of time for users when they want to convert OST to PST after their Exchange server is no longer available or other critical issues with Exchange server or impo…
Changing a few Outlook Options can help keep you organized!
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
CodeTwo Sync for iCloud (http://www.codetwo.com/sync-for-icloud?sts=6554) automatically synchronizes your Outlook 2016, 2013, 2010 or 2007 folders with iCloud folders available via iCloud Control Panel. This lets you automatically sync them with…
Suggested Courses

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question