email spoofing (I think)

[Puckoff]

I have users on my network that are getting emails that are not addressed to them. The emails are from external email addresses by looking at the address.

How can I determine what is going on here. We just recently had some DNS changes made by a third party company about a month ago and now with in the last couple of weeks this seems to be happening.

We are running exch 5.5 on W2K Server SP4

 

[zbnet]

Spam, sent via BCC.

If it's a big problem, you might need an anti-spam solution.

 

[Puckoff]

Yes I believe your right ...sent via BCC

We do have an anti-spam solution ...McAfee Security Sheild. It's not a huge problem right now as some users are getting 1-5 of these emails per day, but its get somewhat annoying. Any ideas how these are getting thru our anti-spam software?

 

[Griffyn]

Anti-spam software is not perfect and never will be. Spammers regularly change their techniques, and e-mail structures to bypass anti-spam software.

SpamAssassin is free and highly regarded, although it's best in a Linux platform and would take some expertise to set up.

We've been using No Spam Today (

http://www.nospamtoday.com)

which is Windows-based, and uses SpamAssassin as one of it's filters to build up a spam profile for each message. You can also add attachment filters, and write your own filters to check against each message.

I recommend it, although keep in mind it's licensing model is not the best and you may need to consider their unlimited-user license. You can also trial it if you like.