Dotnetpanel Forums

I currently operate two SmarterMail servers. One is for my hosting clients mail and the other is a client for whom I have setup a dedicated server.

Both of these mail servers are starting to send spam. I am not sure if the spam is going out to others, but I am getting the spam messages on my own email addresses that look like they come from my own email addresses.

For instance if I have an email like cliff@mydomain.com then I am actually receiving spam for Viagra and the like that looks like it is coming FROM that email and TO that email. Same thing is happening on the dedicated servers.

SmarterTools is telling me that I don't have an SPF but when I look at DNSStuff, it clearly says I have an SPF for both domains as seen below.

I know this is not directly a DNP issue, but I am concerned that if I let it go on too long that my mailservers might get blacklisted or something.

So if anyone can offer advice, or even service for hire to solve this let me know. SmarterMail is a little slow on responding.

Thanks.

Cliff

PASS SPF record You have an SPF record. This is very good, as it will help prevent spammers from abusing your domain. Your SPF record (I don't check to see if it is well designed!) is: "v=spf1 a mx a:mail.theforerunnernetwork.com ip4:216.58.536.119 ~all" "" [TTL=86400]

PASS SPF record You have an SPF record . This is very good, as it will help prevent spammers from abusing your domain. Your SPF record (I don't check to see if it is well designed!) is: "v=spf ip4:66.216.198.65 mx a:mail.blueribbonschools.com ?all" [TTL=86400] 
 

Hi chammock,

looking at your SPF record you are using '?' and '~', maybe you can force a fail using '-' ?  Well as long as they are using that server for relaying emails.  I am personally using 'v=spf1 ip4:xx.xxx.xxx.xxx/27 ~all' but it isn't as strict as your records even.

May want to take a look at http://www.zytrax.com/books/dns/ch9/spf.html

I have made SPF changes, updated to latest SmarterMail and done the following as recommended by SM but the volume of SPAM being sent out under my email address is just getting worse everyday.

• Disabled CatchAlls
• Set Allow Relay to Nobody
• Requiring SMTP Authentication on all domains
• Bypass mail relay settings when using SMTP Authentication

SM support has asked me to remove my own email address from the list of Trusted Senders. This just seems like a band aid in that it might stop some of the SPAM from going out...but I really need to know how and why this is happening. Has someone taken over my server and I don't know it? Or is this SPAM being sent from another server, but somehow just using my email addresses to do it?

Can anyone offer any suggestions? Any SM Experts that are willing to review my setups on two servers I would be more than happy to pay $$ for your services. This is getting pretty urgent.

Thanks so much!

Cliff

Have you checked the SmarterMail logs? that would tell you if the mail is actually going out from your server or not. Have you checked that its not an open relay on something like IIS SMTP (Tip: don't let IIS SMTP deliver mail direct always pass it through your SmarterMail server, makes debugging easier). What happens if you disable your own domain in SmarterMail for a bit? Does the spam stop.

I sometimes get periods of bounces that identify my domain as the sender but these are just spammers using your domain but sending from an open relay or zombie PC somewhere else not necessarily mail going out from my server. Usually this peeks and then dies down to nothing until the next time. There is nothing you can do except configure your SPF record.

I think this may be a catchall issue with another mail server using your email address as a reply-to address. Did you notice any drop off in SPAM once you disabled catch-alls? Do you have greylisting enabled also? 

 Hi Cliff,

The default spam setting is not working good for prevent spam problem. I will configure your smarter mail withiout any spam complaint if you want.

Regards,

SAM