Forum Moderators: phranque
The emails are orininating from Polish, Russian and Croatian IPs. The sites seem to be hosted on private servers and I can't find contacts for them. I have contacted the registrars of the domains in the SPAM and all are unresponsive when I tell them that the contact information is bogus and to remove the nameserver info.
Am I barking up the wrong tree? What else can I do? I would prefer not to ignore it. Is there anything else I should be looking for in the header that might reveal their identity?
Your domain is being used as the fake "From" address. The "bounces" are not your fault, nor are they the fault of the unhappy recipients of the spoofed spam. I would suggest that you set your "default" address to ":blackhole:", so the "bounce" messages addressed to invalid "From" addresses simply disappear.
I'm not conversant on how, exactly, SPF is supposed to work, so I can't help you there.
Eliz.
it went away after a while, I spoke to my own ISP to alert them to the fact that this was happening so they didn't blame me and try to shut me off.
In addition to what others have added, I'd suggest setting up SPF for your domain (if you haven't already). SPF tells mail servers what the legitimate mail servers are for your domain. Anything not going through one of the designated servers should be treated as probable spam.
It's important when you set up SPF to lock down the servers and not leave it open to other servers (which is possible under the spec). This means, however, that when you send something from a place like craigslist it may very well be seen as spam unless they also include a "sender" header.
You can read about SPF at [openspf.org...]
SPF only helps so much since spammers often set up SPF records for the domains they send from, but SPF does help a bit. IMHO, if you have SPF set up for your domain spammers will be less likely to use your domain as the from address since the mail servers that have implemented SPF-based checks will be likely to disgard the message. Many of the big hosts do these checks - AOL, HotMail, two name two big ones.
SPF is set up on the DNS level. To see if SPF is set up for your domain change example.com to your domain in the following URL:
[dnsreport.com...]
That will show you a whole bunch of things about how your DNS record is set up. You'll probably want to follow up on anything that shows up red on the report. If you don't control your DNS settings you'll need to work with your hosting service to get SPF setup.
