E-mail bounce-back of email user didn't send

I've been seeing a few of these a week in our environment, for different users.

But what happens is someone will get an e-mail like this one below, but they don't have anything in their Sent Items (Outlook 2010 or OWA) on the date/time of the timestamp, so I'm not sure why they're getting it or where it could be coming from.

-----Original Message-----
From: postmaster@ourdomain.com [mailto:postmaster@ourdomain.com]
Sent: Thursday, May 16, 2013 10:25 AM
To: David Johnson
Subject: Delivery Notification - New Secure Message

The message or an attachment did not reach the intended recipient(s).!
Subject: New Secure Message
From: narcsqp@anotherdomain.com
To: djohnson@ourdomain.com
Date: Thu, 16 May 2013 09:24:36 -0600
Reason: attachment type policy violation (SecureMessage.exe)
Action: quarantine
Who is Participating?
Alan HardistyConnect With a Mentor Co-OwnerCommented:
It's spam and if you have a decent anti-spam program such as Vamsoft ORF Fusion (www.vamsoft.com) installed and configured, you won't see this arriving.

Setting up an SPF record correctly as advised above will also help the problem.

Rajitha ChimmaniCommented:
Check your server logs which could give information of any attempts. You could also get the source of these emails from the logs.
edster9999Connect With a Mentor Commented:
Bounce back emails are used by spammers for two different tasks.

The first one - they need a 'from' address to send from.  They are not going to use their own address and if they send a million emails from xyz@example.com this will get black listed before they even reach the end of the list.
So their get round is to use emails in the mailing list as 'from'.  They send a small amount from address 1 and then move on.  That person will then receive some bounce backs or some real mails saying 'go away' etc.
You can fake an email address VERY easily.  The email comes from whatever name and email you put it from.

The second method is to use the 'bounce' emails as a method of sending.
If they find a server that bounces emails either because the person doesn't exist or because it looks like spam then they can use this to SEND spam to other people.
Say the company bounces the mail back (maybe even with attachments) if it doesn't know the name.
If the company is called 'example.com'
and I want to send you a spam to 'garryshape@ourcompany.com'

then I send an email saying :

To : no-body-here@example.com
From : garryshape@ourcompany.com
Body : Hi garryshape would you like some viag.......etc etc etc

The company then bounces this back to the from address which is really your address and they have just sent out a spam.

The cure - read up on filtering spam.  You can set up DNS entries for your own domain that will only allow it to come from set IPs (like your mail servers) and you can filter incoming addresses by blacklist/whitelists or by keywords.
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Dave BaldwinConnect With a Mentor Fixer of ProblemsCommented:
It's most likely "Bounce back" or NDR spam.  It's become a common method because a lot of people tend to open them thinking that they actually sent it out.
Malli BoppeConnect With a Mentor Commented:
Only thing I can think of stopping this is having an SPF record for your domain.
garryshapeAuthor Commented:
Thanks, guys. Makes sense to me. Will explore solutions based on findings.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.