<div>
Do you know if this address was ever used to Send As?<br />
Look at the security on this object and see if there are any users that have rights to Send As. This would be the first place I would look. If there are no users that have this right then I would suspect that your address was spoofed.
</div>


<div>
no one has rights to send as. I was trying to find how it got hacked and could not find any logs on exchange server
</div>


<div>
it was web developer who had used DL for old campaign on centos server for auto reply. He responded after 18 hrs. Just had be worried about hacking for nothing when I did not see anything on delivery report
</div>


<div>
<div class="content wysiwyg-content">
How to find the health of distribution list and find the source if it has been hacked.<br />
<br />
We received a an email from client suggesting they receive email from our distribution list. How to completely secure any reply form DL. should msservicepermission on reply be disabled for DL? as it is the only permission send as for DL?
</div>
</div>


How to find the health of distribution list and find the source if it has been hacked.

We received a an email from client suggesting they receive email from our distribution list. How to completely secure any reply form DL. should msservicepermission on reply be disabled for DL? as it is the only permission send as for DL?

Exchange 2013 DL hack

Exchange is the server side of a collaborative application product that is part of the Microsoft Server infrastructure. Exchange's major features include email, calendaring, contacts and tasks, support for mobile and web-based access to information, and support for data storage.