What to do if your e-mail address has been misused

Suddenly getting dozens of bounce messages for mail you never sent? Or are people telling you they're getting strange mail from you? Then your e-mail address is being misused. There are two very different causes, and the approach differs.

Cause 1: someone is using your address as the sender (spoofing)

A spammer can put any address they like as the sender of an e-mail, including yours, without ever getting into your mailbox. They send the mail through their own servers. If that mail doesn't arrive, you get the bounce message back. This is called spoofing.

How to recognise it:

• The bounce messages are about messages you don't recognise, often to unfamiliar addresses abroad.
• In E-mail Tracking (see E-mail Tracking: where did my mail go?) you don't see these messages as outgoing mail. So they weren't sent through our server.

What to do:

1. Make sure SPF, DKIM and DMARC are set up correctly (see Setting up and adding to SPF, Turning on and checking DKIM and Setting up DMARC). With a DMARC policy set to quarantine or reject, you tell other mail servers to put spoofed mail sent in your name into spam or reject it outright. This is the only real protection.
2. Delete the bounce messages. You don't need to reply to them.
3. Usually such a wave stops by itself after a few days.

Changing your password isn't necessary in the case of spoofing, but it can't hurt if you're unsure.

Cause 2: someone has your password (hacked mailbox)

Has someone obtained the password to your mailbox, for example through a phishing e-mail, a virus, or a password you also used elsewhere? Then they can send mail through our server pretending to be you. This is more serious, because spam is then genuinely being sent from your mailbox.

How to recognise it:

• In E-mail Tracking you see outgoing mail that you didn't send yourself. Under Show, select Outbound to see only sent mail.
• In E-mail Accounts, the Sent column for your mailbox shows a much higher number than usual (see Send limits and the 'message limit reached' message).
• You suddenly can't send mail any more because the sending limit has been reached, or you receive a message from us.
• Your sent items, or your webmail settings, contain things you don't recognise, such as a forward to an unknown address.

What to do straight away:

1. Change the password of the mailbox in DirectAdmin (see Changing the password of an email address). Choose a strong, new password that you don't use anywhere else (see Secure passwords and what to do if a password is leaked).
2. Enter the new password on all your devices: computer, phone and tablet (see chapter 8, for example All settings at a glance: servers, ports and security).
3. Check whether a Forwarder or Autoresponder has been added that isn't yours (see Forwarders: forwarding mail to another address and Autoresponders), and remove it.
4. Scan your computer for viruses. A password stolen via a virus could otherwise be captured again.
5. Do you use the same password anywhere else? Change it there too.
6. Let us know via a ticket, especially if sending has been blocked.

Please note: If we notice that spam is being sent from a mailbox, we may temporarily block sending from that mailbox. This protects you and the other customers on the same server: otherwise the server ends up on a blacklist and everyone's mail gets rejected (see Verzenden geweigerd: blacklists en limieten). Change the password first and then get in touch with us, so we can check together whether the mailbox is safe again.

Cause 3: your website is sending the spam

Sometimes the spam doesn't come from a mailbox, but from a website in your package: an unsecured contact form, or a hacked plugin. In E-mail Tracking you'll then see outgoing mail with your DA username or an address from your website as the sender. Secure the form (for example with a captcha), update your website and plugins, and read My website has been hacked: step-by-step plan.

Prevention is better

• Use a unique, strong password for each mailbox and store it in a password manager.
• Don't click links in e-mails asking for your password. WebOké never asks for your password by e-mail.
• Keep DMARC set to Reject (the default at WebOké, see Setting up DMARC), so that spoofed mail sent in your name is blocked.
• Keep your website, plugins and themes up to date.