Solved

E-mail bounce-back of email user didn't send

Posted on 2013-05-16
6
993 Views
Last Modified: 2013-05-17
I've been seeing a few of these a week in our environment, for different users.

But what happens is someone will get an e-mail like this one below, but they don't have anything in their Sent Items (Outlook 2010 or OWA) on the date/time of the timestamp, so I'm not sure why they're getting it or where it could be coming from.


-----Original Message-----
From: postmaster@ourdomain.com [mailto:postmaster@ourdomain.com]
Sent: Thursday, May 16, 2013 10:25 AM
To: David Johnson
Subject: Delivery Notification - New Secure Message

The message or an attachment did not reach the intended recipient(s).!
Subject: New Secure Message
From: narcsqp@anotherdomain.com
To: djohnson@ourdomain.com
Date: Thu, 16 May 2013 09:24:36 -0600
Reason: attachment type policy violation (SecureMessage.exe)
Action: quarantine
0
Comment
Question by:garryshape
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 16

Expert Comment

by:Rajitha Chimmani
ID: 39172796
Check your server logs which could give information of any attempts. You could also get the source of these emails from the logs.
0
 
LVL 20

Assisted Solution

by:edster9999
edster9999 earned 125 total points
ID: 39172935
Bounce back emails are used by spammers for two different tasks.

The first one - they need a 'from' address to send from.  They are not going to use their own address and if they send a million emails from xyz@example.com this will get black listed before they even reach the end of the list.
So their get round is to use emails in the mailing list as 'from'.  They send a small amount from address 1 and then move on.  That person will then receive some bounce backs or some real mails saying 'go away' etc.
You can fake an email address VERY easily.  The email comes from whatever name and email you put it from.

The second method is to use the 'bounce' emails as a method of sending.
If they find a server that bounces emails either because the person doesn't exist or because it looks like spam then they can use this to SEND spam to other people.
Say the company bounces the mail back (maybe even with attachments) if it doesn't know the name.
If the company is called 'example.com'
and I want to send you a spam to 'garryshape@ourcompany.com'

then I send an email saying :

To : no-body-here@example.com
From : garryshape@ourcompany.com
Body : Hi garryshape would you like some viag.......etc etc etc

The company then bounces this back to the from address which is really your address and they have just sent out a spam.

The cure - read up on filtering spam.  You can set up DNS entries for your own domain that will only allow it to come from set IPs (like your mail servers) and you can filter incoming addresses by blacklist/whitelists or by keywords.
0
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 125 total points
ID: 39173243
It's most likely "Bounce back" or NDR spam.  It's become a common method because a lot of people tend to open them thinking that they actually sent it out.
0
Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 
LVL 23

Assisted Solution

by:Malli Boppe
Malli Boppe earned 125 total points
ID: 39173881
Only thing I can think of stopping this is having an SPF record for your domain.
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 125 total points
ID: 39173957
It's spam and if you have a decent anti-spam program such as Vamsoft ORF Fusion (www.vamsoft.com) installed and configured, you won't see this arriving.

Setting up an SPF record correctly as advised above will also help the problem.

Alan
0
 

Author Closing Comment

by:garryshape
ID: 39175571
Thanks, guys. Makes sense to me. Will explore solutions based on findings.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
There's a lot of hype surrounding blockchain technology. Here's how it works and some of the novel ways it' s now being used - including for data protection.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question