Mailbox taken over or spam from your address: here's how to clean up
Are you suddenly getting a lot of error messages (bounces) about mail you never sent, are customers saying they're getting strange mail from you, or did we report that spam is being sent from your address? Then either someone really was in your mailbox, or someone is just using your address as the sender. First work out which of the two it is, because the approach is very different.
First determine: taken over or spoofed?
| What do you see? | Mailbox taken over | Spoofed sender |
|---|---|---|
| Is the mail in your Sent folder or in E-mail Usage in DirectAdmin? | Yes | No |
| Sent column under E-mail Accounts | Much higher than normal | Normal |
| Notice that the sending limit has been reached, or a message from us | Often | No |
| A forward, filter, or auto-reply you don't recognize | Possibly | No |
| Bounces about mail to unknown addresses | Possible | Yes, often a lot |
You can read how to check E-mail Usage and the Sent column in Sending limits and the 'message limit reached' notice.
Spoofed sender: nobody was in your mailbox
A sender address is just text. A spammer can send mail via their own server with your address as the sender, without ever getting into your mailbox. This is called spoofing. If the recipient's server rejects that mail, the error message goes to the address that was listed: to you.
- Changing your password won't help here, because nobody had it.
- The real protection is DMARC. With this, you ask other mail servers to reject spoofed mail sent in your name. If your DMARC record is already set to
p=quarantineorp=reject, leave it as is. If it's set top=none, it doesn't offer protection yet. Read What is DMARC? Explained in plain language and Setting up DMARC. - Delete the error messages. Usually such a wave stops on its own after a few days.
Mailbox taken over: here's how to clean up
If someone has your mailbox password, they're really sending mail through our server, pretending to be you. Do this right away, in this order:
- Work from a clean device. If you opened an attachment or installed something, change your passwords on a different device and scan the first one for viruses. Don't click on links in the suspicious mail.
- Change the mailbox password in DirectAdmin, see Changing the password of an e-mail address. The old password will stop working immediately after that. Choose a new password of at least 15 characters, or a passphrase of five or six random words, generated by a password manager. See Secure passwords and what to do with a leaked password.
- Enter the new password on all your devices. A device that keeps trying the old password can get your IP address blocked, see Am I blocked? Unblock your own IP address.
- Look for backdoors. An attacker likes to set up a rule that forwards mail to their own address or immediately deletes mail from your bank. Remove anything you didn't create yourself in these places:
- Forwarders in DirectAdmin, and the Forwardings tab in My WebOké (E-mail and domain forwardings);
- Autoresponders and Vacation Messages;
- the filters in the webmail settings (Opening webmail), and the rules in your mail program;
- a different reply-to address in the settings of your webmail or mail program.
- Check your other accounts. If you used the same password elsewhere, change it there too. Start with My WebOké: a new password there logs you out of all other devices (Setting, changing, or forgetting your password). Then check the active sessions and log out anything you don't recognize. For DirectAdmin, the steps are in the secure passwords article above, for Nextcloud in Viewing, revoking, or remotely wiping devices and sessions, where you can also revoke app passwords.
- Contact us through a ticket in the Support Center. If spam is being sent from a mailbox, we can temporarily block sending to protect you and the other customers on the server. First change the password; after that we'll check together whether the mailbox is safe again and whether the server is on a blacklist.
- Limit the damage for next time. Give the mailbox its own daily sending limit using Change Limits, see Changing the password or limits of an e-mail address.
- Warn your contacts, especially if it involved invoices or payments. If the mailbox contained customers' personal data, check whether you need to report a data breach to the Dutch Data Protection Authority.
- Report the phishing email that started it all to the Fraud Helpdesk: preferably forward it as an attachment to valse-email@fraudehelpdesk.nl, so the technical details are preserved. Report a text message or WhatsApp message via the report form. If you've lost money, also file a report with the police.
How did someone get your password?
Usually through phishing: a fake email with a link to a fake login page, for example "your mailbox is full". You can read how to recognize this in Recognizing phishing: how to read a link and a sender. Other causes: a password you also used on a website that was leaked, a short password, or a virus. A password manager creates a long, unique password for every mailbox, see Password manager and passkeys: securing your logins.
Is your website sending the spam, or do you want more explanation? Read What to do if your e-mail address has been misused.