[Discuss] e-mails with a "from" address that is of some concern

[mskala at ansuz.sooke.bc.ca]

On Sat, 19 Apr 2014, Alan W. Irwin wrote:
> We have recently started seeing spam that purports to be sent from our
> own computer, e.g., <somename>@<FQDN> where FQDN is the fully
> qualified (and quite unique) local name I happen to give my computer in
> /etc/hosts.

Is it possible that the mail is coming in with no FQDN - for instance, as
<somename> with no @ part, or <somename>@<ip address> - and then your
mailer is assuming that that is local and filling in the FQDN?

> As far as I know, I have never leaked that fully qualified name out in
> e-mail or anywhere else.

Does the box that has this name ever send mail?  If so, the name could
have leaked out via a Received: header.  Does it ever receive mail?  If
so, the name may have appeared in the receiving mailer's HELO or EHLO
identification.

In any case, is this actually a problem?

-- 
Matthew Skala
mskala at ansuz.sooke.bc.ca                 People before principles.
http://ansuz.sooke.bc.ca/