none
Receiving SPAM mails from own mail id.

    Question

  • Dear Team,

    We have Exchange Server 2013 with 50 Users, from last month we are facing problem that many users are

    receiving spam mails from their own email id. Example-  From : abc@xyz.com To : abc@xyz.com.

    Please suggest me solution to get solve this problem.

    Thank You,

    Monday, July 18, 2016 7:52 AM

Answers

  • Hi,

    For your question, you can enable built-in Anti-Spam feature in Exchange 2013 mailbox server role:
    https://technet.microsoft.com/en-us/library/bb201691(v=exchg.150).aspx

    Also, please open one of the spoofed email in outlook and go the properties of the message and go to the headers. There are two types of sender address RFC821 and RFC822. RFC821 is the actual sender and RFC822 is the display name of the sender. Spoofed email means RFC822 address is spoofed, then you can block that sender or domain by sender filter function. For example:

    Set-SenderFilterConfig -BlockedSenders kim@contoso.com,john@contoso.com -BlockedDomains fabrikam.com -BlockedDomainsAndSubdomains northwindtraders.com

    For your reference: https://technet.microsoft.com/en-us/library/bb124087(v=exchg.150).aspx


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Allen Wang
    TechNet Community Support

    Tuesday, July 19, 2016 6:32 AM
    Moderator

All replies

  • This is called Spoofing attack.

    Configure SPF record , Reverse DNS for your domain and  have one SMTP Filtering gateway before the emails are delivered to Exchange.

    By doing this we can control the spam.


    Remember to mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you Check out my latest blog posts on http://exchangequery.com Thanks Sathish (MVP)

    Monday, July 18, 2016 9:14 AM
  • Dear Sathish,

    Thank you so much for reply,

    Actually i am very new in this exchange. Can you please guide me for configuring SPF record & SMTP Filtering gateway. Reverse DNS i can configure.

    Monday, July 18, 2016 9:18 AM
  • Hi,

    For your question, you can enable built-in Anti-Spam feature in Exchange 2013 mailbox server role:
    https://technet.microsoft.com/en-us/library/bb201691(v=exchg.150).aspx

    Also, please open one of the spoofed email in outlook and go the properties of the message and go to the headers. There are two types of sender address RFC821 and RFC822. RFC821 is the actual sender and RFC822 is the display name of the sender. Spoofed email means RFC822 address is spoofed, then you can block that sender or domain by sender filter function. For example:

    Set-SenderFilterConfig -BlockedSenders kim@contoso.com,john@contoso.com -BlockedDomains fabrikam.com -BlockedDomainsAndSubdomains northwindtraders.com

    For your reference: https://technet.microsoft.com/en-us/library/bb124087(v=exchg.150).aspx


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Allen Wang
    TechNet Community Support

    Tuesday, July 19, 2016 6:32 AM
    Moderator
  • Hi Bharat,

    You can create a rule on your Firewall Gateway that if the email contains your domain and it doesn't came from your mail server. It will reject it.

    Thanks.

    Tuesday, July 19, 2016 6:39 AM
  • Thank you Allen for reply first,

    As per your given link i tried with procedure given for enable built-in Anti-Spam feature in Exchange 2013 mailbox server role, but i got error ~

    Tuesday, July 19, 2016 6:49 AM
  • Thank you spideynok for reply,

    If i create rule in Firewall Gateway, can i able to send mails to my company members,

    For example : my email id is abc@xxx.com & my colleague email id is xyz@xxx.com ?

    I mean to say, if email contains my domain blocked by firewall will i able to receive mails internally ?

    Tuesday, July 19, 2016 6:53 AM
  • Hi,

    Please run it in EMS instead of Windows PowerShell.


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Allen Wang
    TechNet Community Support

    Tuesday, July 19, 2016 6:55 AM
    Moderator
  • Hi Allen,

    I enabled Antispam feature and senderfilterconfig also, & observed still receiving mails from own ID.

    Please suggest what can i do to get solve this.

    Thank you,

    Wednesday, July 20, 2016 2:58 AM
  • Hi,

    Would you please post the problematic message header (without sensitive information) for analyze?


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Allen Wang
    TechNet Community Support

    Monday, July 25, 2016 1:21 AM
    Moderator