Spam emails received by my contacts

[#1]

I get messages from friends/contacts that they are receiving emails, allegedly from me but obviously spam, any idea how I can stop these emails being sent

[#2]

It is unlikely that there is anything you can do, as the messages are probably being sent from overseas and spoofing your email address as the sender.

Out of interest, do you access your emails on an iPhone ?, or have your friends/contacts email addresses on an iPhone ?.

I ask because over the years I have received similar looking obvious spam from family members, my kid's teachers, and local tradesmen - and the thing in common is that both their details and my details are EXACTLY as stored in their iPhone contacts - so something in common on their iPhones such as a rogue game app, or dodgy email client app, had probably 'harvested' the contact details and uploaded it to the spammers.

Fortunately having spotted the 'pattern' of the spam from these people in the incoming email headers, I've managed to 100% filter them out using simple Thunderbird client message filtering rules.

[#3]

What you can do will depend on the amount of control you have over your e-mail identity. If you simply use a cloud service like gmail or Hotmail etc then they shouldn't be able to impersonate you on that unless they have hacked your account and are actually sending from that. (I assume the cloud services will have the usual SPF/DKIM set up to prevent third-party servers sending mail in their name and verify the sender's log-in before accepting outgoing mail over SMTP.) - Remedy: change your password to something more secure.

If you send through PN using a PN address the spammers would presumably need to have a PN account to get through but I hope PN's relay would have the same precautions as the cloud services above - but maybe not. In that case there's nothing you can do.

If you have your own domain you can set up your own SPF record including madasafish.com. This will probably result in Spam being blocked by your contacts' providers.

If you have your own server you can go even further, but in that case you'd probably already know about many of the options.

[#4]

@kjpetrie 

There are some inaccuracies / misunderstandings in your comments.

To appear to be sending as a specific party does NOT require access to the user's email account.  Mail can be sent via any available (open / accessible) SMTP server as fred@bloggs.plus.com if you know how.

SPF does NOT prevent the sending of email by an "unauthorised" SMTP service.  SPF defines the authorised SMTP server for the sending domain, for the benefit of the receiving MX service which uses that information (if it wants to) to help determine the spam score.

If a user's PN mail account has been hacked or the hacker has open access to Plusnet's SMTP server (they are on the network), then SPF is not going to help here.

The only condition for which changing the mail account's password "Remedy: change your password to something more secure" would be where the user's account has been compromised and is being abused by a third party.  If that were the case, it is more likely that Plusnet's security measures will have detected such abuse and locked the account before the user was aware that there is an issue.

Indeed less memorable passwords are technically more secure, however such passwords then tend to NEED to be written somewhere less they be forgotten.

[#5]

@Townman,You seem to have misunderstood my post completely. In my first paragraph I referred to someone with a gmail, hotmail etc account where one has to log in to send mail using that identity. In that case a third party could only send mail from that account using the user's gmail etc address if they had logged in as that user. Assuming the cloud service concerned has SPF etc records it would be easy to spot if the domain were spoofed and most contacts would therefore not receive mails sent from a spoofed gmail etc address, since their providers would reject it.

My second paragraph expresses the expectation PN would not permit people sending through its relay people submitting with a from address not matching the account logged in for webmail or by SMTP from an IP other than the one allocated to the user at the time of sending. If that is not done it would be poor security. Again, a spoofed mail from an unauthorised server would easily be spotted.

In the third paragraph I use the word "probably" and "by your contact's providers" to indicate the blocking has to happen at the recipient's end.

Therefore, the precautions I suggested in the three scenarios would protect the OP's contacts from receiving much of the spoofed mail being sent to them in his/her name, which was the question being asked.

I have my own domains and have discovered many providers will no longer accept mail (or will treat it as spam) unless the domain has a DKIM match. As I could not achieve that using PN's server I have had to set up and configure my own to use DKIM. I do know how these things work.

[#6]

@kjpetrie 

@Townman  is far more qualified to respond but may I just point out that emails can be sent  by any third party who enters the OP’s  address in the ‘from’ field. Yes, it will fail SPF but I believe that the SPF check is not mandatory. I do not know if, for example, Plusnet does this validation.

[#7]

@Baldrick1 

Indeed none of these RFC standards are mandatory.

In the case of SPF, it is not mandator that the sending party specifies a policy identifying authorised SMTP servers.  Similarly if a SPF does exist for the sending domain, there is no obligation on the receiver to check it and make a judgement call on accepting or rejecting delivery.  Even if all of this were obligatory, most SPFs are set to soft-fail which effectively makes them purely advisory.

@kjpetrie 

The context of the discussion was abuse of a Plusnet email address.  If you want to bring Google into the discussion, that system allows (certainly allowed - they are forever changing functionality) "send on behalf of" which makes an email appear to have been sent by a third party.  You do not need to go anywhere near the real account holder's mailbox.

[#8]

My second paragraph expresses the expectation PN would not permit people sending through its relay people submitting with a from address not matching the account logged in for webmail or by SMTP from an IP other than the one allocated to the user at the time of sending. If that is not done it would be poor security.

@kjpetrie a Plusnet broadband customer can legitimately use the Plusnet mail relay from any IP PROVIDING they authenticate with valid Plusnet credentials. Likewise, you can not legitimately prevent them using the relay to send email from a domain address they may own and have registered elsewhere.

Whether such email is accepted by the receiving server depends on whether they are able to specify an SPF record, using their providers DNS, which defines the Plusnet relay as a permitted sender ?

[#9]

This is getting tiresome. The OP at no point specified the spoofed address was a PN one. People are assuming that.

As for the information I've given, I'm not claiming it's foolproof - just suggesting a few basic precautions.

I was simply trying to help someone who'd been told there was nothing to be done when there might be things that could help. None of us has enough information to give a definitive response.