Avatar of Moonatwork
Moonatwork
Flag for Afghanistan asked on

receiving spam emails from our own email addresses

Hi,
i am using OS Win 2003 Server sp2
MS Exchange server 2003 Sp2

Since 4 days some of our staff receiving spam emails using our their own email addresses,
when i see from email address, its their own email address

and some receving from different email address but same domain name, that user doen't exist in our domain...
i contacted our email filter provider websense, they said it looks like spoofing your domain,

how to prevent this, how to to find out who is spoofing our domain. what are the best ways to protect our domain and email system by thsese kind of problems..
AntiSpamExchangeDNS

Avatar of undefined
Last Comment
Dustin_Loftis

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Alan Hardisty

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Wesley Miller

You can't really stop spoofing itself as anyone can send an email and act as an imposter.
Example, IF you send an email from outlook before sending it click on options you can choose have replies sent to and the email going out will say its from that email instead of the one it was sent from.
The only way I know of to prevent them is to look at the header information from the received email and block emails from the source mail server it came from.
With the email opened in outlook again click options and at the bottom will be the header information look through it for X-MS-Exchange-Organization-PRD and block that domain from sending your system emails.
Return-Path: pwfbounces@mailer1.texterity.com
X-MS-Exchange-Organization-PRD: texterity.com
 

OutllokSendOptionsImposter.png
Wesley Miller

Attachment of what header info looks like.

Emailheaderseder.png
Alan Hardisty

@wmiller - The way to stop this is to use Sender Filtering or anti-spam software.  If you are not familiar with Exchange, please refrain from posting in the Exchange Zone.
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
SOLUTION
Dustin_Loftis

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Alan Hardisty

To be honest, if you are receiving spoofed mail and you are using a mail filtering service, I would ditch the service and bring it in-house as Websense seems to be a waste of time and money.
Are you paying more than $239 per year for Websense?  If you are, ditch them and install Vamsoft.  Trial it first, but you will be impressed with the results.
Dustin_Loftis

Have you gotten this issue resolved?