Every now and then, I receive e-mails with an obvious malevolent payload (such as a Word document with harmful macros).

I am not worried by these e-mails, which I can recognize, but I noticed that the alleged senders are all employees of the same company, which I know. Anyway, the senders addresses are fanciful.

So my question is: what is more likely ? That their mailbox has been hacked and abused, or that my own mailbox was hacked ?

Is there a way to know ?

It's hard to say for sure, but I think this is the most likely scenario:

• The sender's domain name does not have an SPF record that restricts what IP addresses are allowed to send emails for the domain.

Other possible scenarios off the top of my head in descending order of likeliness from my experience:

• The senders' email account or email server has been compromised and is sending spam to contacts known on the server.


• The senders' domain name does have sensible SPF records, but your mail server's anti-spam software is not checking for spoofed emails.


• Your mail server or account has been compromised, and a malware distributor is using your contacts list to place malware emails in your inbox.

Scenario 1 – Sender SPF Misconfigured

This is the most likely scenario because you indicated in an update to your question that the senders' email addresses are "fanciful"; the spoofing sender may not necessarily know any real mailboxes at the target domain.

Symptom

You receive an email from someone, but that person denies sending the email. They may be able to show no matching record in their sent messages folder or even the sending server's email logs.

Cause

The sender's domain name does not have an SPF (Sender Policy Framework) record that prevents spoofing.

Diagnosis

You can check the SPF record of domain example.com with this command:

nslookup -type=TXT example.com

Replace example.com with the sender's domain name. You may see a record that looks like this:

"v=spf1 +a +mx +ip4:127.0.0.1 -all"

In the example above,

• 
  +a means to allow the IP address(es) of the domain's A record(s) to send emails on behalf of this domain.


• 
  +mx means to resolve the domain's MX records and allow those domains to send emails, too.


• 
  +ip4:127.0.0.1 means to allow the IP address 127.0.0.1 to send emails for this domain.


• 
  -all means to reject all other IP addresses from sending emails for this domain.

If the sender does not have -all in their SPF record, receiving mail servers that validate SPF may accept spoofed emails that could have been sent by anyone.

You can check the actual sender of the email by reading the Received: headers in the malicious email you received. The Received: headers are in the reverse order of each mail server the email passed through, but note that the headers not added by your mail server can be spoofed. The first Received: header added by your mail gateway shows where the email came from. Example:

Received: from mail-eopbgr810054.outbound.protection.outlook.com ([40.107.81.54]:59584 helo=NAM01-BY2-obe.outbound.protection.outlook.com)

    by example.deltik.org with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)

    (Exim 4.91)

    (envelope-from <jason@luxurylifestylereport.net>)

    id 1gUudZ-00BGJx-L7

    for example@deltik.org; Thu, 29 Nov 2018 06:49:21 -0600

In the example above, the email came from 40.107.81.54, which passed the SPF record ("v=spf1 include:spf.protection.outlook.com -all") check on the spam sender's domain, luxurylifestylereport.net, so the email was accepted.

Alternatively, if you have access to the email server logs, you can read the origin of the email from there.

Resolution

The sender's postmaster should configure an SPF record for their domain that prevents spammers from spoofing the domain for emails. This is not something that you can do.

Until their postmaster fixes this, you can try adjusting your anti-spam settings to block emails with malicious attachments or spammy contents.

Scenario 2 – Sender's Email Compromised

This scenario is less likely because you said this problem happens every now and then, but someone else should have noticed and reported this in the past.

Symptom

You can see in the email headers that the email came from an IP address that is permitted to send emails for the sender's domain.

Cause

The mail server at the IP address or a server that sends mail through it has been compromised. The hacker may also have found a copy of contacts that the sender knows about and is trying to email those in the hopes of finding someone relatable.

Diagnosis

Same process as that of Scenario 1

Resolution

The sender's postmaster needs to stop and secure their email system. This is not something that you can do.

Until their postmaster fixes this, you can try adjusting your anti-spam settings to block emails with malicious attachments or spammy contents.

Scenario 3 – Receiving Mail Server Doesn't Check SPF Records

This scenario is less likely because spammers won't want to waste resources to try to spoof emails for a domain that already protects itself from spoofing. You'd probably get a lot of spoofed mail from other domain names, too.

Symptom

You receive an email from someone, but that person can prove they didn't send it. In fact, anyone can validate that the domain's SPF record is configured properly, yet the email you received came from an IP address forbidden by the domain's SPF record.

Cause

Your email server is not filtering out spoofed emails.

Diagnosis

Same process as that of Scenario 1, but you can see that the sender's IP address fails the SPF check

Resolution

Consult your email server's documentation for how to configure SPF validation.

Scenario 4 – Recipient Email Account Compromised

This scenario is less likely because it's more lucrative to hide the fact that you've been compromised from you and use your email address's good reputation to send out spam to others. Also, the malicious entity probably would be diversifying the source email address.

Symptom

Your incoming email logs don't show the email that appeared, or the headers of the received email don't make sense.

Cause

Someone is hoping to get more access to you by dropping malware emails into your already compromised email account without actually sending any emails. Emails can be added over the IMAP protocol.

Diagnosis

Check your mail server logs for authentications that you don't recognize.

Resolution

Change your email account's password.