Backscatter Spam

Soldato
Joined
19 Oct 2002
Posts
2,742
Location
Auckland, New Zealand
I've got a small mailserver in my house i use for my personal email. I'm now being inundated with replies from mail servers worldwide that the address isn't valid, full etc. I've looked in to my network using wireshark to see if somewhere in the network I've been infected and a rouge server/pc is sending to the SMTP server, but I see tons of external source IPs with replies from my server back to them.

I'm assuming as wireshark hasn't shown the spam originating from inside my network that it is backscatter spam, i.e. spoofed headers using my email address which then bounces back if the server doesn't have a valid address or other issues with the server. How long does this normally go on for? I'm receiving 10s of thousands of NDRs and replies from servers across the world (including some funny replies).

Any thoughts are appreciated.
 
The email header should show the originating IP, your smtp server isn't an open relay is it?

SPF set up?
 
Set up DMARC on your domain, you should see mail servers drop the spoofed messages rather than replying with an NDR.
 
Back
Top Bottom