My Distribution List Sending Spam

Mido3mad · Post by **Mido3mad** » Sat Oct 20, 2012 3:30 am

Hi all,
We notice today that is our distribution list sending spam outside ( dont know how ) but it sending by distribution list mail address
and /var/log/zimbra.log and audit.log seems to be normal
Any Help?

justdave · Post by **justdave** » Sat Oct 20, 2012 3:40 am

The From line on email can be spoofed. Is the mail actually going through your mail server or is someone just using your address? You'll need to look at the Received: headers in the email to figure that out.

Mido3mad · Post by **Mido3mad** » Sat Oct 20, 2012 3:58 am

Sorry It was originally sending from other server sending and its replay path as my distribution list address

I add this domain to my blacklist there is any other ideas to solve it?
at anyway can i send mails from distribution list ??

justdave · Post by **justdave** » Sat Oct 20, 2012 5:07 am

The From address is generated by your email client. Whatever you have configured in it is what it'll use, and you can change that to whatever you want. (This is using clients such as Thunderbird, Postbox, Outlook, etc). I know in Thunderbird you can add additional "identities" that aren't your primary email address, but are associated with your account. I use this for replying to mail to our hostmaster and abuse addresses (which are distribution lists) so that the From address when I reply shows as the hostmaster or abuse address.

Mido3mad · Post by **Mido3mad** » Sat Oct 20, 2012 5:17 am

Ya it make me confused
I checked my spf record and its working fine any solution to not make other send by my domain name or its depend on the server they sending spam from?

justdave · Post by **justdave** » Sat Oct 20, 2012 8:32 am

SPF is only stating your intentions, it's up to the recipient of the email whether they honor those intentions or not. A lot of places still don't. Anyone who's actually checking SPF on mail coming from your domain would reject it or tag it as spam if it didn't originate on your servers, but anyone who's not checking the SPF will still get it, and there's not really anything you can do about it. That's just the way mail works. You just have to hope the recipients are smart enough to check the headers and realize it didn't actually come from you.

Mido3mad · Post by **Mido3mad** » Sun Oct 21, 2012 8:11 am

hope so

better thing that my mail working fine
and we dont receive any undelivered messages anymore i think they realize it and mark it as a spam

Mido3mad · Post by **Mido3mad** » Sun Oct 21, 2012 8:11 am

Thanks dave