Solved

E-mail bounce-back of email user didn't send

Posted on 2013-05-16
6
959 Views
Last Modified: 2013-05-17
I've been seeing a few of these a week in our environment, for different users.

But what happens is someone will get an e-mail like this one below, but they don't have anything in their Sent Items (Outlook 2010 or OWA) on the date/time of the timestamp, so I'm not sure why they're getting it or where it could be coming from.


-----Original Message-----
From: postmaster@ourdomain.com [mailto:postmaster@ourdomain.com]
Sent: Thursday, May 16, 2013 10:25 AM
To: David Johnson
Subject: Delivery Notification - New Secure Message

The message or an attachment did not reach the intended recipient(s).!
Subject: New Secure Message
From: narcsqp@anotherdomain.com
To: djohnson@ourdomain.com
Date: Thu, 16 May 2013 09:24:36 -0600
Reason: attachment type policy violation (SecureMessage.exe)
Action: quarantine
0
Comment
Question by:garryshape
6 Comments
 
LVL 16

Expert Comment

by:Rajitha Chimmani
ID: 39172796
Check your server logs which could give information of any attempts. You could also get the source of these emails from the logs.
0
 
LVL 20

Assisted Solution

by:edster9999
edster9999 earned 125 total points
ID: 39172935
Bounce back emails are used by spammers for two different tasks.

The first one - they need a 'from' address to send from.  They are not going to use their own address and if they send a million emails from xyz@example.com this will get black listed before they even reach the end of the list.
So their get round is to use emails in the mailing list as 'from'.  They send a small amount from address 1 and then move on.  That person will then receive some bounce backs or some real mails saying 'go away' etc.
You can fake an email address VERY easily.  The email comes from whatever name and email you put it from.

The second method is to use the 'bounce' emails as a method of sending.
If they find a server that bounces emails either because the person doesn't exist or because it looks like spam then they can use this to SEND spam to other people.
Say the company bounces the mail back (maybe even with attachments) if it doesn't know the name.
If the company is called 'example.com'
and I want to send you a spam to 'garryshape@ourcompany.com'

then I send an email saying :

To : no-body-here@example.com
From : garryshape@ourcompany.com
Body : Hi garryshape would you like some viag.......etc etc etc

The company then bounces this back to the from address which is really your address and they have just sent out a spam.

The cure - read up on filtering spam.  You can set up DNS entries for your own domain that will only allow it to come from set IPs (like your mail servers) and you can filter incoming addresses by blacklist/whitelists or by keywords.
0
 
LVL 82

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 125 total points
ID: 39173243
It's most likely "Bounce back" or NDR spam.  It's become a common method because a lot of people tend to open them thinking that they actually sent it out.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 23

Assisted Solution

by:Malli Boppe
Malli Boppe earned 125 total points
ID: 39173881
Only thing I can think of stopping this is having an SPF record for your domain.
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 125 total points
ID: 39173957
It's spam and if you have a decent anti-spam program such as Vamsoft ORF Fusion (www.vamsoft.com) installed and configured, you won't see this arriving.

Setting up an SPF record correctly as advised above will also help the problem.

Alan
0
 

Author Closing Comment

by:garryshape
ID: 39175571
Thanks, guys. Makes sense to me. Will explore solutions based on findings.
0

Featured Post

Too many email signature updates to deal with?

Do you feel like you are taking up all of your time constantly visiting users’ desks to make changes to email signatures? Wish you could manage all signatures from one central location, easily design them and deploy them quickly to users? Well, there is an easy way!

Join & Write a Comment

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now