# Exchange Logs (2003) non-domain addresses as senders **URL:** \ **Category:** Factual Questions\ **Created:** [June 17, 2013, 7:21pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201 "2013-06-17T19:21:53Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![PatriotX](https://avatars.discourse-cdn.com/v4/letter/p/c4cdca/32.png) [@PatriotX](https://boards.straightdope.com/u/PatriotX)\ **Post date:** [June 17, 2013, 7:21pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/1 "2013-06-17T19:21:53Z")
Examining Exchange Logs (2003) I find sender addresses which are not from our domain. Some are from \@gmail.com But some are from places like notifications+vvv4pysz53iuhw (at) [zyngamail.com](http://zyngamail.com) update+zj4oc9to=j96 (at) [facebookmail.com](http://facebookmail.com) cialis-soft.order133 (at) [sampson-multimedia.com](http://sampson-multimedia.com) viagra-pro.online (at) musicaedischi.it Why is that? How is that? ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [June 17, 2013, 7:37pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/2 "2013-06-17T19:37:06Z")
They’re not logs of messages sent TO your users? ---
**Author:** ![PatriotX](https://avatars.discourse-cdn.com/v4/letter/p/c4cdca/32.png) [@PatriotX](https://boards.straightdope.com/u/PatriotX)\ **Post date:** [June 17, 2013, 7:53pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/3 "2013-06-17T19:53:05Z")
> [@ZipperJJ](#): > > They’re not logs of messages sent TO your users? About 1/3 of recipient addresses from these senders are in my domain. The other 2/3 of the recipients are predominantly gmail, yahoo, and hotmail, with a sprinkling of various other domains in there. Which is what is puzzling to me. If the e-mail is from outside my domain and headed outside my domain, why is it on my domain? ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [June 17, 2013, 8:10pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/4 "2013-06-17T20:10:14Z")
Do any of your users have forwarding set up? ---
**Author:** ![sleestak](https://avatars.discourse-cdn.com/v4/letter/s/919ad9/32.png) [@sleestak](https://boards.straightdope.com/u/sleestak)\ **Post date:** [June 17, 2013, 9:04pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/5 "2013-06-17T21:04:32Z")
Is your mail server an open relay? Slee ---
**Author:** ![PatriotX](https://avatars.discourse-cdn.com/v4/letter/p/c4cdca/32.png) [@PatriotX](https://boards.straightdope.com/u/PatriotX)\ **Post date:** [June 17, 2013, 9:14pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/6 "2013-06-17T21:14:25Z")
> [@ZipperJJ](#): > > Do any of your users have forwarding set up? There’re about a dozen accounts of former employees set to forward to current employees. ---
**Author:** ![PatriotX](https://avatars.discourse-cdn.com/v4/letter/p/c4cdca/32.png) [@PatriotX](https://boards.straightdope.com/u/PatriotX)\ **Post date:** [June 17, 2013, 9:44pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/7 "2013-06-17T21:44:16Z")
> [@sleestak](#): > > Is your mail server an open relay? > Slee nope ---
**Author:** ![Space\_Vegetable](https://avatars.discourse-cdn.com/v4/letter/s/6de8d8/32.png) [@Space\_Vegetable](https://boards.straightdope.com/u/Space_Vegetable)\ **Post date:** [June 17, 2013, 10:33pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/8 "2013-06-17T22:33:12Z")
Maybe you’re looking at From fields, or other fields in the message header? Those can be anything, and have no relation to message origin or delivery. (Only the addresses in the message envelope are used for delivery.) You could have bogus From fields in incoming spam, or in outgoing email due to spam being forwarded by your users. ---
**Author:** ![PatriotX](https://avatars.discourse-cdn.com/v4/letter/p/c4cdca/32.png) [@PatriotX](https://boards.straightdope.com/u/PatriotX)\ **Post date:** [June 17, 2013, 10:43pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/9 "2013-06-17T22:43:07Z")
> [@Space\_Vegetable](#): > > Maybe you’re looking at From fields, or other fields in the message header? Those can be anything, and have no relation to message origin or delivery. (Only the addresses in the message envelope are used for delivery.) > > You could have bogus From fields in incoming spam, or in outgoing email due to spam being forwarded by your users. I am looking at logs from an Exchange 2003 server. Here are the titles of the columns in the log ```auto # Date Time client-ip Client-hostname Partner-Name Server-hostname server-IP Recipient-Address Event-ID MSGID Priority Recipient-Report-Status total-bytes Number-Recipients Origination-Time Encryption service-Version Linked-MSGID Message-Subject Sender-Address ``` I am referring to the content of “Sender-Address” column and the “Recipient-Address” column. Hope that helps. ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [June 17, 2013, 11:24pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/10 "2013-06-17T23:24:08Z")
> [@PatriotX](#): > > nope yep ---
**Author:** ![Space\_Vegetable](https://avatars.discourse-cdn.com/v4/letter/s/6de8d8/32.png) [@Space\_Vegetable](https://boards.straightdope.com/u/Space_Vegetable)\ **Post date:** [June 18, 2013, 12:32am UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/11 "2013-06-18T00:32:14Z")
I don’t know Exchange, but the fact that it shows both Sender-Address and Recipient-Address suggests to me that it’s merely showing some message header fields, which are easy for a spammer to fake. (The only reliable address, the delivery address in the envelope, has no corresponding reliable sender address.) [This page](http://technet.microsoft.com/en-us/library/cc539064.aspx) says the sender address logged is merely the Sender or From field from the message header, regularly spoofed by spammers. But it’s too vague about the recipient address to tell what it really means. So you don’t need to worry about whatever junk appears in the Sender-Address field, at any rate. ---
**Author:** ![PatriotX](https://avatars.discourse-cdn.com/v4/letter/p/c4cdca/32.png) [@PatriotX](https://boards.straightdope.com/u/PatriotX)\ **Post date:** [June 18, 2013, 12:41am UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/12 "2013-06-18T00:41:19Z")
> [@yoyodyne](#): > > yep I checked via PoSH’s Get-ReceiveConnector I tested manually via this method: [http://www.spamsoap.com/smtp-open-relay-test/](http://www.spamsoap.com/smtp-open-relay-test/) I used these online testers: [http://www.mailradar.com/openrelay/](http://www.mailradar.com/openrelay/) > **[Network Tools: DNS,IP,Email](https://mxtoolbox.com/SuperTool.aspx?action=smtp%3a12.199.54.22&run=toolpage)** > > DNS and Network troubleshooting and diagnostic tools integrated into one sweet interface. Before I replied. If you know another, better way to check for an open relay, please share. ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [June 18, 2013, 2:11am UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/13 "2013-06-18T02:11:55Z")
Are the client IPs your computers? ---
**Author:** ![PatriotX](https://avatars.discourse-cdn.com/v4/letter/p/c4cdca/32.png) [@PatriotX](https://boards.straightdope.com/u/PatriotX)\ **Post date:** [June 18, 2013, 3:07pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/14 "2013-06-18T15:07:07Z")
> [@yoyodyne](#): > > Are the client IPs your computers? Yes, they are all from a handful of local servers. ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [June 18, 2013, 5:10pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/15 "2013-06-18T17:10:24Z")
The servers are clients to Exchange? What is generating the mail? ---
**Author:** ![PatriotX](https://avatars.discourse-cdn.com/v4/letter/p/c4cdca/32.png) [@PatriotX](https://boards.straightdope.com/u/PatriotX)\ **Post date:** [June 20, 2013, 2:06pm UTC](https://boards.straightdope.com/t/exchange-logs-2003-non-domain-addresses-as-senders/661201/16 "2013-06-20T14:06:03Z")
> [@yoyodyne](#): > > The servers are clients to Exchange? What is generating the mail? Machines further down the line. They’re cas iirc I won’t be back at work to check other logs for days.