# spoofed e-mail from my client's domain ... any defense?

**URL:** <https://boards.straightdope.com/t/spoofed-e-mail-from-my-clients-domain-any-defense/269112>\
**Category:** Factual Questions\
**Created:** [October 13, 2004, 11:01pm UTC](https://boards.straightdope.com/t/spoofed-e-mail-from-my-clients-domain-any-defense/269112 "2004-10-13T23:01:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![toadspittle](https://avatars.discourse-cdn.com/v4/letter/t/c0e974/32.png) [@toadspittle](https://boards.straightdope.com/u/toadspittle)\
**Post date:** [October 13, 2004, 11:01pm UTC](https://boards.straightdope.com/t/spoofed-e-mail-from-my-clients-domain-any-defense/269112/1 "2004-10-13T23:01:23Z")

</div>

One of my Web clients recently got an angry feedback e-mail from someone who received some sort of spam (slamming GWB, apparently) that originated from the e-mail address “[slyofh@myclientsdomain.com](mailto:slyofh@myclientsdomain.com)”.

He’s e-mailed this woman back, and she’s going to forward the full spam message to him, so we can look at the headers.

The question is, is there any defense against this sort of thing? I’m not too familiar with e-mail spoofing.

---

<div class="post-metadata">

**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\
**Post date:** [October 14, 2004, 12:04am UTC](https://boards.straightdope.com/t/spoofed-e-mail-from-my-clients-domain-any-defense/269112/2 "2004-10-14T00:04:18Z")

</div>

No.

The spoofed address (usually a virus) comes from an infected computer with an e-mail address in your domain somewhere on its hard drive. It can be anywhere: in an address book, in a cached web page, in the body of a file or e-mail message, etc. The very best you can do is figure out what IP address the infected computer was using, but that’s not going to do much to narrow it down, and the ISP probably won’t give you any information if you ask.

In the case of a spammer, they’re probably just picking your domain at random. Again, it will be impossible to track down (unless you can get a subpoena, but I doubt you could).

---

<div class="post-metadata">

**Author:** ![micco](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@micco](https://boards.straightdope.com/u/micco)\
**Post date:** [October 14, 2004, 1:16pm UTC](https://boards.straightdope.com/t/spoofed-e-mail-from-my-clients-domain-any-defense/269112/3 "2004-10-14T13:16:43Z")

</div>

There is no defense in that there is nothing you can do to prevent this from happening. Anyone anywhere can send mail with anything in the headers.

There is recourse if you can track down the source. There was a case in Texas several years ago where a small company won a judgement against a spammer who spoofed the return address by demonstrating that the angry replies and bounce messages caused damage to her business, both her reputation and her ability to conduct business because the traffic brought down her servers. I think she ended up spending more on the investigation and proceedings than she won in the judgement, but it was a huge moral victory. Of course, in order to do this you have to find the source, not just the sender. If the email is political glurge rather than commercial spam, that may be very hard to do.