Now getting spam where the 'from' and 'to' address are my own email address -

Question asked by Michael Robinson - 8/4/2018 at 11:48 AM

Unanswered

I've been getting spam where both the from email and to email address are my own email address.

The message header says: SPF_Fail, DKIM_None

But it passes because: X-SmarterMail-TotalSpamWeight: 0 (Trusted Sender - System)

Any suggestions? Any settings I should look at?

Thanks

Here is the full header:

Return-Path: <michael@mydomain.com>

Received: from 11-176-244-190.fibertel.com.ar (11-176-244-190.fibertel.com.ar [190.244.176.11]) by mail.mydomain.com with SMTP;

Fri, 3 Aug 2018 08:31:14 -0700

Message-ID: <001a01d42b25$0537d61c$b7919687@iathbte>

From: <michael@mydomain.com>

To: <michael@mydomain.com>

Subject: Hi dear!

Date: 3 Aug 2018 07:59:22 -0400

MIME-Version: 1.0

Content-Type: text/plain;

charset="cp-850"

Content-Transfer-Encoding: 8bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-SmarterMail-Spam: Commtouch 30 [value: Confirmed], ISpamAssassin 20 [raw: 12], SPF_Fail, DKIM_None, Custom Rules []

X-SmarterMail-SpamDetail: 2.8 HELO_DYNAMIC_IPADDR2

X-SmarterMail-SpamDetail: 2.4 FH_HELO_EQ_D_D_D_D

X-SmarterMail-SpamDetail: 2.4 KHOP_SC_TOP_CIDR8

X-SmarterMail-SpamDetail: 0.0 TVD_RCVD_IP

X-SmarterMail-SpamDetail: 2.6 RDNS_DYNAMIC

X-SmarterMail-SpamDetail: 2.6 DOS_OE_TO_MX

X-SmarterMail-SpamDetail: 0.2 FM_SEX_HELODDDD

X-CTCH-RefId: str=0001.0A090204.5B647551.003B,ss=4,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=12

X-SmarterMail-TotalSpamWeight: 0 (Trusted Sender - System)

9 Replies

Reply to Thread

Ron Raley Replied

8/5/2018 at 2:58 PM

Hi Michael,

The message was received from this source:

Received: from 11-176-244-190.fibertel.com.ar (11-176-244-190.fibertel.com.ar [190.244.176.11]) by mail.mydomain.com with SMTP;

So if you are not that source, then I would recommend that you update your password and kick that ip session off your server.

Thanks,

Ron

Matt Petty Replied

8/6/2018 at 7:22 AM

Employee Post

Hello,

What version of SmarterMail are you running? We have checks in place to not "zero" the spam weight if DKIM or SPF fail.

Matt Petty Software Developer SmarterTools Inc. (877) 357-6278 www.smartertools.com

kevind Replied

8/6/2018 at 9:29 AM

Known issue from a couple years ago...

https://portal.smartertools.com/community/a87739/vulnerability-local-domains-being-spoofed.aspx

And a follow-up:

https://portal.smartertools.com/community/a89857/spam-from-the-own-user.aspx

David Fisher Replied

8/6/2018 at 9:51 AM

Hi,

Sounds to me like he has his email address in the trusted senders :

X-SmarterMail-TotalSpamWeight: 0 (Trusted Sender - System)

Last I knew you were not suppose to have your own email address or domain in the trusted senders, as spammers will use your own email address to bypass the spam filters.

Michael Robinson Replied

8/6/2018 at 2:09 PM

Hi Matt

we are using

SmarterMail Professional Edition
Version: 16.3.6558

Michael Robinson Replied

8/6/2018 at 2:10 PM

IS this true ?

My own address is a trusted sender.

Is that bad?

Matt Petty Replied

8/7/2018 at 7:44 AM

Employee Post

No, we have a check (in 16+) that disables trusted sender functionality on a message if it fails DKIM or SPF. This is an example of what this looks like when it occurs. If it's coming from an external source and you have properly configured DKIM/SPF then it should fail authenticity.

System possible values.
X-SmarterMail-TotalSpamWeight: 30 (Trused Sender - System, failed DKIM)
X-SmarterMail-TotalSpamWeight: 30 (Trused Sender - System, failed SPF)
X-SmarterMail-TotalSpamWeight: 0 (Trused Sender - System)
This same thing applies to
Trusted Sender - Domain
Trusted Sender - User
Trusted Sender - Contact

Matt Petty Software Developer SmarterTools Inc. (877) 357-6278 www.smartertools.com

Michael Robinson Replied

8/7/2018 at 10:59 AM

I don't see anything like that - where it says 'Trused Sender - System, failed DKIM)'

and i do have dkim and spf set up and running correctly according to all my tests.

Do I have to flick a switch to get this part of the system to work?

Matt Petty Replied

8/7/2018 at 12:05 PM

Employee Post

Hmm you shouldn't have to.
If you'd like you can message me (via DM by clicking my name) and if you can send me the relevant snippets from the SMTP log and Delivery log (make sure they are set to detailed), I can quickly scope out to see if there are issues.

Matt Petty Software Developer SmarterTools Inc. (877) 357-6278 www.smartertools.com

Back to Community Threads

Please leave this box unchecked

9 Replies

Reply to Thread

Tags

Related Knowledge Base Articles