End-User who "recieved" an email from themselves

Hello,
  
     I have a user who "recieved" an email from themselves- which was really 
a spam message. The exchange tracking log states the the suspect email sender 
as our user with the username@domainname.com address. 
If I select properties of that sender in tracking, the message ID is 
20060526063745.9DABB145B3@mail.domainname.com

Our real user is listed as just their username in message tracking, and the 
message ID properties are:
87DC2EAA1613A34C9FB3A3940CF3A8C91BA382@exchangeserver.domainname

The Spam filter states the email originated from outside our network. My 
question is, what can I do about this, besides block the supposed IP? How can 
I best address this problem?

-- 
Thank you,
Brian
0
5/26/2006 6:07:02 PM
exchange.admin 57650 articles. 2 followers. Follow

8 Replies
569 Views

Similar Articles

[PageSpeed] 21

On Fri, 26 May 2006 11:07:02 -0700, Brian
<briansawyer@koc-pa.com.(donotspam)> wrote:

>Hello,
>  
>     I have a user who "recieved" an email from themselves- which was really 
>a spam message. The exchange tracking log states the the suspect email sender 
>as our user with the username@domainname.com address. 
>If I select properties of that sender in tracking, the message ID is 
>20060526063745.9DABB145B3@mail.domainname.com
>
>Our real user is listed as just their username in message tracking, and the 
>message ID properties are:
>87DC2EAA1613A34C9FB3A3940CF3A8C91BA382@exchangeserver.domainname
>
>The Spam filter states the email originated from outside our network. My 
>question is, what can I do about this, besides block the supposed IP? How can 
>I best address this problem?


Install a anti-spam filter that allows you to block messages that have
a FROM: that equals any domain you are authorative for.
You may also want to check SPF records on inbound mail.
0
adavid (8731)
5/26/2006 6:41:45 PM
Hello Andy,

   So, from the Spam filter- block any incoming addresses that are from my 
domain, because a legitamate email from our domain would be generated 
internally? Do I understand that correctly?

 -- 
Thank you,
Brian


"Andy David - MVP" wrote:

> On Fri, 26 May 2006 11:07:02 -0700, Brian
> <briansawyer@koc-pa.com.(donotspam)> wrote:
> 
> >Hello,
> >  
> >     I have a user who "recieved" an email from themselves- which was really 
> >a spam message. The exchange tracking log states the the suspect email sender 
> >as our user with the username@domainname.com address. 
> >If I select properties of that sender in tracking, the message ID is 
> >20060526063745.9DABB145B3@mail.domainname.com
> >
> >Our real user is listed as just their username in message tracking, and the 
> >message ID properties are:
> >87DC2EAA1613A34C9FB3A3940CF3A8C91BA382@exchangeserver.domainname
> >
> >The Spam filter states the email originated from outside our network. My 
> >question is, what can I do about this, besides block the supposed IP? How can 
> >I best address this problem?
> 
> 
> Install a anti-spam filter that allows you to block messages that have
> a FROM: that equals any domain you are authorative for.
> You may also want to check SPF records on inbound mail.
> 
0
5/26/2006 7:22:02 PM
On Fri, 26 May 2006 12:22:02 -0700, Brian
<briansawyer@koc-pa.com.(donotspam)> wrote:

>Hello Andy,
>
>   So, from the Spam filter- block any incoming addresses that are from my 
>domain, because a legitamate email from our domain would be generated 
>internally? Do I understand that correctly?

Pretty much. Ensure you do not have any processes external to your org
that insert an address in the FROM: with your SMTP domain.

>
> -- 
>Thank you,
>Brian
>
>
>"Andy David - MVP" wrote:
>
>> On Fri, 26 May 2006 11:07:02 -0700, Brian
>> <briansawyer@koc-pa.com.(donotspam)> wrote:
>> 
>> >Hello,
>> >  
>> >     I have a user who "recieved" an email from themselves- which was really 
>> >a spam message. The exchange tracking log states the the suspect email sender 
>> >as our user with the username@domainname.com address. 
>> >If I select properties of that sender in tracking, the message ID is 
>> >20060526063745.9DABB145B3@mail.domainname.com
>> >
>> >Our real user is listed as just their username in message tracking, and the 
>> >message ID properties are:
>> >87DC2EAA1613A34C9FB3A3940CF3A8C91BA382@exchangeserver.domainname
>> >
>> >The Spam filter states the email originated from outside our network. My 
>> >question is, what can I do about this, besides block the supposed IP? How can 
>> >I best address this problem?
>> 
>> 
>> Install a anti-spam filter that allows you to block messages that have
>> a FROM: that equals any domain you are authorative for.
>> You may also want to check SPF records on inbound mail.
>> 
0
adavid (8731)
5/26/2006 7:34:37 PM
What would be an example of something external?
-- 
Thank you,
Brian


"Andy David - MVP" wrote:

> On Fri, 26 May 2006 12:22:02 -0700, Brian
> <briansawyer@koc-pa.com.(donotspam)> wrote:
> 
> >Hello Andy,
> >
> >   So, from the Spam filter- block any incoming addresses that are from my 
> >domain, because a legitamate email from our domain would be generated 
> >internally? Do I understand that correctly?
> 
> Pretty much. Ensure you do not have any processes external to your org
> that insert an address in the FROM: with your SMTP domain.
> 
> >
> > -- 
> >Thank you,
> >Brian
> >
> >
> >"Andy David - MVP" wrote:
> >
> >> On Fri, 26 May 2006 11:07:02 -0700, Brian
> >> <briansawyer@koc-pa.com.(donotspam)> wrote:
> >> 
> >> >Hello,
> >> >  
> >> >     I have a user who "recieved" an email from themselves- which was really 
> >> >a spam message. The exchange tracking log states the the suspect email sender 
> >> >as our user with the username@domainname.com address. 
> >> >If I select properties of that sender in tracking, the message ID is 
> >> >20060526063745.9DABB145B3@mail.domainname.com
> >> >
> >> >Our real user is listed as just their username in message tracking, and the 
> >> >message ID properties are:
> >> >87DC2EAA1613A34C9FB3A3940CF3A8C91BA382@exchangeserver.domainname
> >> >
> >> >The Spam filter states the email originated from outside our network. My 
> >> >question is, what can I do about this, besides block the supposed IP? How can 
> >> >I best address this problem?
> >> 
> >> 
> >> Install a anti-spam filter that allows you to block messages that have
> >> a FROM: that equals any domain you are authorative for.
> >> You may also want to check SPF records on inbound mail.
> >> 
> 
0
5/26/2006 7:44:03 PM
On Fri, 26 May 2006 12:44:03 -0700, Brian
<briansawyer@koc-pa.com.(donotspam)> wrote:

>What would be an example of something external?


Some companies have websites managed externally that forwards emails
to internal users etc that may have the internal smtp domain listed in
the FROM... 
Users may go to a website and select to have somethign sent to them
and use their own address as both the TO: and FROM:. 

Things like that. 
0
adavid (8731)
5/26/2006 7:53:21 PM
Andy David - MVP <adavid@pleasekeepinngcheesebucket.com> wrote:

					[ snip ]

>>The Spam filter states the email originated from outside our network. My 
>>question is, what can I do about this, besides block the supposed IP? How can 
>>I best address this problem?
>
>
>Install a anti-spam filter that allows you to block messages that have
>a FROM: that equals any domain you are authorative for.
>You may also want to check SPF records on inbound mail.

Or publish the names/addresses of the SMTP server/clients you will
allow to send mail on behalf of your domain. See http://openspf.org
for more info.

Rather than block mail, it's sometimes better to either add "points"
to the messages spam score if it comes from your domain, or to rewrite
the message subject so it says something like "**WARNING--forged
'FROM:' address:".

There are lots of ways to deal with this, but it does require
something more sophisticated than the IMF or ORF.

-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@getronics.com
Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
0
richnews (7316)
5/27/2006 1:24:17 AM
Thanks for thie tips. I will apply a filter and test it.
-- 
Thank you,
Brian


"Andy David - MVP" wrote:

> On Fri, 26 May 2006 12:44:03 -0700, Brian
> <briansawyer@koc-pa.com.(donotspam)> wrote:
> 
> >What would be an example of something external?
> 
> 
> Some companies have websites managed externally that forwards emails
> to internal users etc that may have the internal smtp domain listed in
> the FROM... 
> Users may go to a website and select to have somethign sent to them
> and use their own address as both the TO: and FROM:. 
> 
> Things like that. 
> 
0
6/7/2006 6:46:47 PM
Thanks for the advice. I will look into adding points if the filter does not 
succeed.
-- 
Thank you,
Brian


"Rich Matheisen [MVP]" wrote:

> Andy David - MVP <adavid@pleasekeepinngcheesebucket.com> wrote:
> 
> 					[ snip ]
> 
> >>The Spam filter states the email originated from outside our network. My 
> >>question is, what can I do about this, besides block the supposed IP? How can 
> >>I best address this problem?
> >
> >
> >Install a anti-spam filter that allows you to block messages that have
> >a FROM: that equals any domain you are authorative for.
> >You may also want to check SPF records on inbound mail.
> 
> Or publish the names/addresses of the SMTP server/clients you will
> allow to send mail on behalf of your domain. See http://openspf.org
> for more info.
> 
> Rather than block mail, it's sometimes better to either add "points"
> to the messages spam score if it comes from your domain, or to rewrite
> the message subject so it says something like "**WARNING--forged
> 'FROM:' address:".
> 
> There are lots of ways to deal with this, but it does require
> something more sophisticated than the IMF or ORF.
> 
> -- 
> Rich Matheisen
> MCSE+I, Exchange MVP
> MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
> Don't send mail to this address mailto:h.pott@getronics.com
> Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
> 
0
6/7/2006 7:00:59 PM
Reply:

Similar Artilces:

how do i tell if the reciepient of an email has recieved it?
how can i set up email so i can tell if the recipient has recieved/opened it without having them actually reply back to me?? You cannot, excepting via a read receipt which they can ignore, if their mail server accepts the reciept in the first place "GreenEyes" <GreenEyes@discussions.microsoft.com> wrote in message news:14E2779D-970B-422B-9C60-DF751B53323B@microsoft.com... > how can i set up email so i can tell if the recipient has recieved/opened > it > without having them actually reply back to me?? Hi GreenEyes,, did you try the "read/receipt" o...

Is there any way to edit a recieved message in Outlook 2007
I just updated to 2007 from 2003. In 2003, I could click "Edit" from the menu of an opened message, and add annotations. I can't seem to figure out how to do this in 2007 -- I don't see that as an option in the available menus when I have a message open, nor from the list of messages. Press the Other Actions button to reveal the Edit Message option. -- Robert Sparnaaij [MVP-Outlook] Coauthor, Configuring Microsoft Outlook 2003 http://www.howto-outlook.com/ Outlook FAQ, HowTo, Downloads, Add-Ins and more http://www.msoutlook.info/ Real World Questions, Real...

automating emails recieved to a table
As part of my role, I receive many autogenerated emails when our online training is completed. I file them in various folders in outlook. I would like to have them saved to a table in an Access database so that I can then track my training records with. Any Ideas how to automate this? Yes. I have a sample that I can share with you. If you are interested, send me a private e-mail message with a valid reply-to address. My e-mail address is available at the bottom of the contributor's page indicated below. Please do not post your e-mail address (or mine) to a newsgroup reply. Doing ...

Exchg 2K3 POP3 mail is not being recieved
Hello All, I have A Win 2K3 SBS using Exchange for calendar sharing, and I set up an smtp connector, and a pop3 connector to send/recv email via my external email sources. All was working well, but today I am not receiving any email. I used to get 300+ daily including junk. I looked at my pop3 mail acct boxes using web mail access, and mail is going into them. I tell the exchange box to get the mail from the pop3 boxes, and look at the pop3 boxes with web access, and all mail is gone (should be on the exchange server waiting for my outlook 2k3 client to pull it to my desktop). When I tell out...

Tasks Not Recieved, Messages OK, No NDR
Exchange 2003 SP2 just updated through June's updates, Server 2003 SP1 When our intern assigns an Outlook task, it is not recieved by me. I can assign and send her one fine. This behaviour seems to have begun when the recent updates were applied, is anyone aware of a problem? There is nothing new in the bad mail folder, nothing in the pickup folder, nothing in the ESM queueu, on the senders machine the task is put in the sent folder and listed in her task list as "waiting for response from recipient"...she can send email messages no problem. Can someone point me to the ...

Time Zone of recieved message
Is there a way to detemine the time zone that a message was sent from? ...

recieved attachment. as excel spreadsheet, how do I open?I dont.
How do I open an attachment to a e-mail that is a Excel spreadsheet? I do not have Microsoft Office. Thank you You can download a free Microsoft Excel Viewer from the Microsoft . Search for microsoft excel viewer free in Google. Try this URL: http://www.microsoft.com/downloads/details.aspx?FamilyID=c8378bf4-996c-4569-b547-75edbd03aaf0&displaylang=EN Regards Trevor "Lost" <Lost@discussions.microsoft.com> wrote in message news:8A71DA8A-26D6-435A-838F-0828CC9790E3@microsoft.com... > How do I open an attachment to a e-mail that is a Excel spreadsheet? I do...

Where are folders stored ? Sent ? Recieved?
Hard drive crashed and I have rebuilt. Old drive may have outlook folders intact; sent, recieved etc. Where does outlook store files in variouse versions. it would be a 2000 vintage of Outlook Express. Mark B wrote: > Hard drive crashed and I have rebuilt. > > Old drive may have outlook folders intact; sent, recieved > etc. > > Where does outlook store files in variouse versions. it > would be a 2000 vintage of Outlook Express. Wrong newsgroup! This newsgroup is for Outlook which is a PIM (personal information manager) with e-mail and a component of Microsoft Offic...

Delivery Reciepts Not being recieved
Recently on a few of my users when they try to send mail internally or externally Delivery receipt notification is not being returned to the users. I can see the actual delivery receipts in the local delivery queue, but they will just sit there. One thing I have noticed is it happens only through user names starting with A through D. They are able to send and recive mail fine it is just simply on the delivery receipts. I do not have any events in event viewer out of the ordinary. ...

Cannot open outlook items recieved as an attachment
I received several attachments that are in 'outlook item' format and I cannot open them? What can I do? > I received several attachments that are in 'outlook item' format and I > cannot open them? What can I do? MSG files? Upgrade Google Desktop to the most recent release, uninstall it, or tell it to stop looking at msg files. -- -f.h It worked! thanks "F.H. Muffman" wrote: > > I received several attachments that are in 'outlook item' format and I > > cannot open them? What can I do? > > MSG files? Upgrade Google Deskt...

Exmerge
I received this error log when running the exmerge application. I was able to get it running under a Windows XP, but i installed it under Win 2k3 server and I receive this error. I double checked all permissions on the mail storage and the domain account has receive as, send as permission. I'm using the pst to mail storage option on exmerge. Please see the following error below. **************************************************************** Microsoft Exchange Mailbox Merge Program, v6.5.7529.0 Start Logging:July 28, 2006 13:42:24 ***********************************************...

End-User who "recieved" an email from themselves
Hello, I have a user who "recieved" an email from themselves- which was really a spam message. The exchange tracking log states the the suspect email sender as our user with the username@domainname.com address. If I select properties of that sender in tracking, the message ID is 20060526063745.9DABB145B3@mail.domainname.com Our real user is listed as just their username in message tracking, and the message ID properties are: 87DC2EAA1613A34C9FB3A3940CF3A8C91BA382@exchangeserver.domainname The Spam filter states the email originated from outside our network. My questio...

Automate processing of recieved email in Exchange
Hi All, I need to parse incoming e-mail (to a particular email address hosted on an Exchange server). The email is generated by a web site which then encrypts the data with PGP and sends it to a specific address. Can Exchange be programmed to decrypt the e-mail and safe the contents to a file? If not, are there any third party software anyone knows about that may assist? Thanks, best regards, Matt Seddon. ...

txt attachment in every recieved email
Hello, I am working with outlook xp At some points (seems randomly) I get text attachments to every singl incoming message. The attached is a file with the contents of th message, and there is nothing additionally attached. Any ideas why this happens and how to resolve? Thanks. - ----------------------------------------------- ~~ Message posted from http://www.ExcelTip.com ~~View and post usenet messages directly from http://www.ExcelForum.com ...

emailing from excel 2003 thru outlook 2007 is not being recieved
I currently have outlook 2007 and excel 2003 when I send a workbook as attachment it is never recieved. what is causing this issue? ...

recieve copy back that e-mail recieved and opened
i want to recieve a message back that e-mail has been recieved and opened. You can request this in Outlook but you may not get the responses you wish. Servers may deny delivery receipts and if a recipient is using Outlook 2002 or newer, they can deny read receipts. However, in order to request the read and delivery receipts, you can check the boxes in the options of your email before you send it. If you don't see the options button in your open email, click View > Options. If you want to do this for every email that you send (I wouldn't really recommend this), then clic...

Read receipt & Delivery notification not recieved
Exchange 5.5 sp4, clients are outlook xp and 2000. When client checks box for read receipt and or delivery notification, delivery notification not sent and reciptiant is not asked if they want to send a reciept and sender does not recieve a notice that message was read. Any help would be great. ...

P/L question when selling items not yet recieved in GP
Hi, My question is how does GP handle the following? We have a busy warehouse and often times will recieve a shipment, sell many of the items in that shipment, and the purchase order to the shipment may not be posted until a few days after. So if we recieve a shipment on Monday, sell it on Tuesday and override the qty shortage because we know we physically have the goods. And finally get around to putting the PO in on Thursday or something -- will SBF report that I made 100% profit on that sale? Or will it attribute the cost from the PO on thursday to that sale on Tuesday? We use aver...

save Recieved task not opening
OLK03/WinXP/Exch environment - I sent a single user a task. She can not open it, accept it, decline it or delete it. The same message keeps appearing which reads: Please save the task order by clicking SAve task Order on the Actions menu in the "Tasks Folder". The view must not be filtered or grouped for Save Task Order to be avialable. COuld not complete the operation. One or more parameter values are not valid. OK And this occurs only since the last Security Update? Microsoft is working on the issue. Try searching "can not accept tasks" to see the threads of grief...

duplicate message body in recieved emails
I have a situation where when people recieve plain text emails here at work, we get the email but alot of information including header information and virus scan information as well as a second copy of the email message body appears at the end of the email. I don't know if this is an email client, exchange (we use exchange 2000), or other issue. Has anyone had a simialr problem? Do you have any AW or AS Software installed which could cause this? "mojo1138" <mojo1138@discussions.microsoft.com> wrote in message news:47C3EF69-AA69-42C0-ADFF-2B61D76AA7FE@microsoft.co...

Email recieved later than setn from another user.
I've got a user using Office 97 and a Outlook 2000 installation. The problem she is having is that if anyone in our company sends her an email - she doesn't get it right away. Instead she'll get it up to 20 minutes later along with a bunch of other emails that were sent to her. Also, if she scrolls through her email - she will get the waiting emails. F5 seems to work too, but not anyone else is having this prolem. Any ideas out there? "John Garcia" <John Garcia@discussions.microsoft.com> wrote in message news:BFF5D417-1F59-4A53-8C15-B34269F13DE9@microsoft....

Word docs recieved via e-mail won't open
I am having trouble opening some excel and word documents recieved via E-Mail the error is as follows "Passed printers 1 can not be accessed. the file may be read-only, or you may be trying to access a read only location, Or, the server the document is stored on may not be responding" The E-mail server is running fine and the documents are not read only, Can anybody help please Thanks Mark .. ...

can't use the click-to-send in a recieved e-mail
Hi All, Using Microsoft outlook (office) Did something (installed and removed Photodex Gold) - trial time ran out. Created one file, removed the program (uninstalled). The problem is: When I 'click' on an e-mail address in a message that I received, the photodex program opened instead of opening the mail to indow. - So I removed the photodex program. Now I just found the show that I created - I deleted it . (i t ended in an '.exe'... ) NOW when I try "click to send" from inside an e-mail that I received, the 'Locate Link Browser opens up with the ".exe...

error message recieved when accessing outlook
I am having network issues with outlook and exchange. I get an error message on several different peoples machines when i try to open outlook. We use Exchange 5.5 and mainly outlook 2000. the error message reads: "There are no additional Microsoft Exchange client licenses available. Contact your system administrator to obtain a client license to use Microsoft Exchange." What is the problem and how do i remedy this???? thanks, Ryan It means exactly what it says - the server running license logging thinks you've used all your available licenses. Make sure you have eno...

Turning off html for recieved emails
Is it possibla to turn off html for incoming messages in Outlook 2000? Thanks -- Tendril ___________________________ A mistake is only a mistake If one learns nothing from it See http://www.slipstick.com/dev/code/zaphtml.htm for some ideas -- Sue Mosher, Outlook MVP Author of Microsoft Outlook Programming - Jumpstart for Administrators, Power Users, and Developers http://www.outlookcode.com/jumpstart.aspx "Tendril" <dontuspamtendril@shotgunsandwich.net> wrote in message news:4005b4ff$0$223$fa0fcedb@lovejoy.zen.co.uk... > Is it possibla to turn off htm...