Can anyone tell me about email headers?

ecchi · 2005-09-25, 09:15 AM

I either have a problem that my email address is being spoofed in spam (which is bad) or that someone has hacked the sendmail on my server (which is a lot worse). Can anyone tell me from the following header extract:

Received: (qmail 5181 invoked from network); 25 Sep 2005 09:45:20 -0000
Received: from ex1.exmasters.com (81.31.38.4)
by nfmail.abuse.net with SMTP; 25 Sep 2005 09:45:19 -0000
Received: by ex1.exmasters.com (Postfix, from userid 2427)
id 35C81BC59; Sun, 25 Sep 2005 11:38:56 +0200 (CEST)

If "Received: by ex1.exmasters.com" means the email "passed through" ex1.exmasters or if it means the message originated on a server where "ex1.exmasters" is the DNS address.

Thanks.

doublep · 2005-09-26, 12:21 PM

Looks like you have been Joejobbed. Check out the following link for more info.

http://members.cox.net/joejob/

Good luck!

Cheers.

ecchi · 2005-09-26, 01:28 PM

Thanks.

natalie · 2005-10-05, 07:13 PM

I have just had this happen with one of my domains too. I took off the catchall and sent an email to my host to see if they have any solutions.

2005-09-25, 09:15 AM	#1
ecchi Banned Join Date: Oct 2003 Location: About to be evicted!!!! Posts: 4,082	Can anyone tell me about email headers? I either have a problem that my email address is being spoofed in spam (which is bad) or that someone has hacked the sendmail on my server (which is a lot worse). Can anyone tell me from the following header extract: Received: (qmail 5181 invoked from network); 25 Sep 2005 09:45:20 -0000 Received: from ex1.exmasters.com (81.31.38.4) by nfmail.abuse.net with SMTP; 25 Sep 2005 09:45:19 -0000 Received: by ex1.exmasters.com (Postfix, from userid 2427) id 35C81BC59; Sun, 25 Sep 2005 11:38:56 +0200 (CEST) If "Received: by ex1.exmasters.com" means the email "passed through" ex1.exmasters or if it means the message originated on a server where "ex1.exmasters" is the DNS address. Thanks.

2005-10-05, 07:13 PM	#4
natalie Whoo! 9/10 the way to buddy plays in "The Christ from Oz"! Join Date: Aug 2003 Location: Australia Posts: 921	I have just had this happen with one of my domains too. I took off the catchall and sent an email to my host to see if they have any solutions. __________________ No 2257 woes with Retroraunch Submit to my Punani And my Pink Pussy

2005-09-26, 12:21 PM	#2
doublep If something goes wrong at the plant, blame the guy who can't speak English Join Date: Apr 2003 Location: Europe Posts: 306	Looks like you have been Joejobbed. Check out the following link for more info. http://members.cox.net/joejob/ Good luck! Cheers.

2005-09-26, 01:28 PM	#3
ecchi Banned Join Date: Oct 2003 Location: About to be evicted!!!! Posts: 4,082	Thanks.