Problem with spam emails purporting to come from me

[Ian J]

I have had over 4,000 emails today from various mail hosts saying that my outgoing email couldn't be delivered although I didn't actually send them and a spammer has obviously spoofed my email address as a return address.

Is this likely to do me any harm as I would hate to find my genuine emails being blocked by spam filters.

 

[Andy Cornish]

Does your web host not monitor spam or anyone hacking your account ?

 

[fisicx]

If the emails have come from an external source there isn’t much a host can do.

The email headers should indicate where the emails originated. It’s possible the account has been hacked.

 

[Ian J]

The email headers should indicate where the emails originated. It’s possible the account has been hacked.

Another 492 received overnight. The problem is that the emails that I am receiving are genuine as they are from mail hosts telling me that "my" email couldn't be delivered.

I have attached some of the source code below:-

<< DELETED FOR PRIVACY ^Ozzy >>

 

[fisicx]

As you say, they are spoofing your email account. Change your passwords of even suspend the email account.

It’s probably not originating from your server. You are just getting the responses from the failed delivery.

 

[Ozzy]

@Ian J I've edited your post to delete some of the source as it contained some details probably best not posting on a public forum.

I recommend you look at adding DKIM and SPF configs to your domain name. These enable mail servers to verify if the email has really come from you, and reject emails as fake if they don't come from the places and are not verified with your DKIM keys. Gmail and Yahoo next month are enforcing this for all email they receive so any emails sent to those addresses without being setup could end up not being delivered.

Replying to this post has just given me an idea for new How To article to post on here, so keep an eye out
If you want to do it sooner, I've just found this guide which seems pretty good.

 

[Andy Cornish]

Any good host have these DKIM and SPF enabled by default.

 

[Ozzy]

Here you go @Ian J - a quick little explanatory piece with links to some tools to test your domain name setup;

Safeguard Your Business Emails: How to Stop Spoofing with DMARC, DKIM, and SPF

Whilst helping other UKBF members on the forums I came across this post from Ian J who had suddenly received over 4,000 emails from various hosts detailing the apparent spam they thought he had sent could not be delivered. Ian had not sent these...

www.ukbusinessforums.co.uk

 

[DontAsk]

Any good host have these DKIM and SPF enabled by default.

Any good host will set them up for you. Have you tried asking your host?

 

[Nighthawk Software]

Any good host have these DKIM and SPF enabled by default.

This is only possible if your email and domain are hosted by the same company. If you use Outlook or Gmail then you will need to set this up yourself.

 

[Ian J]

Any good host will set them up for you. Have you tried asking your host?

I'd never even heard of it until just now

 

[Paul Kelly ICHYB]

Even more important to get it sorted now!

New Google Marketing Email Requirements

If you run your own email marketing server/system, you should already have it set up correctly, but now the need is going to be greater: New requirements for bulk senders By February 2024, Gmail will start to require that bulk senders: Authenticate their email: You shouldn’t need to worry...

www.ukbusinessforums.co.uk

 

[DontAsk]

I don't understand the MXTool chekcs.

An MXLookup says I have no DNS record and no DMARC policy, Individual checks show that these are in place.

 

[DontAsk]

I'd never even heard of it until just now

Then either you already have the correct setup or I don't know why you have not seen e-mails being rejected by Google.

 

[Andy-UK]

Has someone spoofed your email address or are they actually sending from your account?

What kind of email are you using? Your own domain with free email? Microsoft 365? Gmail?

 

[Ian J]

Has someone spoofed your email address or are they actually sending from your account?

What kind of email are you using? Your own domain with free email? Microsoft 365? Gmail?

My email was spoofed as nothing was actually sent from my account and I could see from inspecting the source code that it wasn't my IP address either.

I am currently still using Outlook 2003 to receive emails but Thunderbird to send them

 

[Peacecloud Ltd]

Can be hard to prevent that one, but as I think someone said above, it's worth asking your provider about SPF and DMARC records.

 

[Andy-UK]

My email was spoofed as nothing was actually sent from my account and I could see from inspecting the source code that it wasn't my IP address either.

I am currently still using Outlook 2003 to receive emails but Thunderbird to send them

They could send from your account and the IP be different!

Any reason why you're using 20 year old software? That's been unsupported and vulnerable since April 2014. And leaving all the data within it vulnerable!

Microsoft 365 is only a few quid each month and very easy to secure.