	Home Web Hosting domains Domains

Customer Support

Support Categories:

Getting Started
FTP
Moving Domains
E-mail
Stat Reports
Mailing Lists
Apache
PHP
CGI
MySQL Database
Other Software
Billing & Terms
Control Panel
E-commerce
Pre-Sales

Search for keywords:

Browse by category:

Someone is sending viruses or spam that appears to come
"from" an address at my domain.

This type of abuse happens frequently to many domain name owners, since spammers rarely use their own domain names in SPAM and viruses select addresses randomly from other people's address books.

Sometimes spammers just make up return addresses to put in their spam and it is a coincidence that this time they chose one that happens to belong to you. Sending an email that appears to have come FROM someone who did not send it is known as "forging email".

Anyone with Outlook or any other email program can forge whatever address they want in the FROM field of an email, regardless of whether they own the domain name in the address, regardless of whether they have permission to use it, and regardless of whether the domain name even exists or is valid. There is nothing that the rightful owner of a domain name can do to stop people from sending out email with an address in the FROM field using someone else's domain name.

There also is nothing that a webhost can do to stop or prevent spammers or virus mails from wrongfully claiming that your email address came FROM or was the sender of a piece of spam or email virus.

The most you can probably do about this is to go to Spamcop and report SPAM and just delete virus mails and the bounce messages that may be coming to you as the purported sender.

The most annoying part of having someone forge your email address in the FROM field of their outgoing SPAM is that nondelivery and other bounce notifications will be returned to you because the undeliverable messages appear to come FROM your address.

There are a couple of ways to avoid receiving those. If the username part (left of the @ symbol) of the forged FROM address is not a mailbox that you set up in your Control Panel, then you are receiving the unwanted messages through your catch-all forwarding rule (The catch-all rule allows you to receive mail addressed to any address @yourdomain). To stop receiving these messages, you could delete your catch-all rule so that you will no longer receive mail addressed to non-existent addresses at @yourdomain. Or, if you want to keep your catch-all rule, but just want to disable incoming email for one particular address, you can create a new forwarding rule in your Control Panel for the unwanted address and set it to forward to mwtrash-nobounce@modwest.com.

If the forged email address is one that is important to you, that you need to receive email at, there is nothing that can be done short of using your Spam Filter in your Control Panel to blacklist the FROM addresses in the undeliverable notices, such as: postmaster@* and then setting the Spam Filter to either delete spam automatically or automatically move it into another folder. However, this is not recommended because messages FROM those type of addresses are often important and most of the time you will want to receive them.

User-Contributed Notes

01-Feb-2004 20:37

There is nothing even Kevin Mitnick can do about this.

Neither the FROM nor TO addresses in emails have anything to do with who
an email is from or who it's to. Anyone, or any virus, can put whatever
they want in those fields before sending out any email. That's just how
email is.

In the case of viruses, there are millions of people who have the latest
virus that is causing this. It does no good to track down any of those
people and ask them to fix their computers. They either don't know how
to fix their computers or their computers are running unattended.

In the case of people who do this intentionally, there is no point in
trying to find them either because they usually launch their mails from
Korea or other places that won't cooperate with any investigations.
Besides, if you get them shut down at one ISP, they start up again in 15
minutes blasting out the same thing from a new ISP.

You can waste a lot more of your time trying to figure it out than it
takes the perpetrator to maintain the attack.

That is why it is a waste of time to look at the headers or to try to
figure anything out about the mails. They are just a nuisance and should
be deleted.

anonymous -at- example.com
13-Jul-2006 10:01

I respectfully disagree. 

In the case of viruses, I have had good luck tracking down the owners of
the IP addresses in the headers, and letting their admin of record know
they have an infected user. We now get very, very few viral email, and I
can immediately notice even numerically small spikes. I would say that
we get viral email from less than half a dozen infected systems, and
fewer viral email in an average week than we have users. 

In addition to being able to immediately tell when we started getting
fresh spew, I reason that once someone knows they have gotten infected,
they can be more careful in the future. Can I prove that? No. But it
stands to reason that if they don't find out, they likely won't be more
careful later. We had one sender who was infected with no less than
three different viruses, until their ISP finally contacted them. I want
to avoid seeing that. 

I also figure that we are not the only recipients in their address book.
By taking just the few minutes to do this, I'm doing others a favor as
well. 

I just wish virus fighting was as mainstream as fighting spam. But
there's nothing like spamcop for trying to eliminate infected users. But
there could be, and should be. 

Aren't you glad your fire department doesn't take the laissez faire
approach to fires? ;-)

Related Questions:

Sending email takes a long time and then fails.

I get "relaying denied" when trying to send email from my computer.

My ISP does not give me an SMTP/Outgoing mailserver to send mail from my own computer, so I must use yours.

How do I send email?

Do you have screenshots of Outlook Express configurations?

How do I receive and read e-mail?

Occasionally, Outlook Express just asks for my username and password but will not let me get my mail.

Why can't I send or receive email with large attachments?

Do you have screenshots of Entourage 2004 configurations?

Do you support Secure POP and IMAP?

I can't get my email because I am continually asked to retype my mailbox password, or am getting a [LOGIN-DELAY] error.

Why am I getting spam?

Can I have a special MX record so a different mailserver like everyone.net or my own Exchange server will handle all mail for my domain?

Is there a way I can bounce all email addressed to unknown users?

How many email addresses can I have and how do aliases work?

How do I delete hundreds or thousands of emails easily?

Can I pipe email to a program?

Can I have an automatic reply sent to people who email me while I'm on vacation?

How do I protect email that contains sensitive information?

When I use webmail, my address on outgoing mails is inaccurate.

Can I do mass emailings through my ISP that advertises my website?

I cannot get into webmail.

When I "Add Mailbox" in Onsite, it says "That login name is already taken. Please choose another."

I receive too much SPAM: what can I do?

Do you scan email for viruses?

My website forms are spamming me with 'gibberish@mydomain.com' or Form Email Injection Attack

How does the mail server filter spam and viruses?

Why won't my email attachment go through?

Which e-mail protocol should I use, POP or IMAP?

Why are HTML emails a security hazard?

How Do I Backup My Email?

How do I view full email headers?

I get this error when logging into Webmail: Security failure, data decryption error

How do I import addresses into webmail?

Do you support anti-forgery standards (SPF / DomainKeys) for email?

How do I forward e-mail in OnSite?

Do you purge messages from Trash and Spam folders?

Why can't I forward @mydomain.com email to my ISP mailbox?

Why is/isn't an email being marked as spam?

Why can't I delete messages from my mailbox if it is over quota?

Can I have an email address which both stores and forwards mail?

How can I access my Modwest mail from another provider's webmail?

What does the "Flag Subject" radio button do in OnSite spam settings?

Browse Categories:

Getting Started, FTP, Telnet/SSH, Moving Domains, E-mail, Traffic Reports, Mailing Lists, Apache, PHP, CGI, Other Server-Side Scripting, MySQL Database, Imaging Libraries, Other Software, Billing & Terms, Control Panel, E-commerce, Pre-Sales