Carlos, The important piece of the headers when you're trying to figure out if the headers are spoofed or your smtp config is broken isthe Received from/by lines. See below
>>> On Wed, Feb 4, 2009 at 10:55 AM, Carlos Williams <carlosw...@gmail.com> >>> wrote: > I received an email this morning that I was confused / concerned by. I > am looking at the headers however I am not sure exactly how to make > this out. This is obviously spam and I did not send myself spam. > The sender shows my email address as well as the recipient address > however when I view the full message headers, I can see the 'Return > Path' is to a different address. Does that mean that the headers were > spoofed to look > like I was the sender? Just trying to understand how to read this and > also make sure I don't have a serious problem here. > > Return-Path: <carlosw...@pten.org> > X-Original-To: carlosw...@example.com > Delivered-To: carlosw...@example.com > Received: from localhost (localhost [127.0.0.1]) by $my_mail_server > (Postfix) with ESMTP id 9D1FD1FA4BBF for <carlosw...@example.com>; > Wed, 4 Feb 2009 07:59:01 -0500 (EST) > Received: from $my_mail_server ([127.0.0.1]) by localhost > ($my_mail_server [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id These two lines show your mail routing through amavisd > tax+kKxS6xrS for <carlosw...@example.com>; Wed, 4 Feb 2009 07:58:59 > -0500 (EST) > Received: from amerblind.outbound.ed10.com (pfz2203.tam.ne.jp > [210.133.173.203]) by $my_mail_server (Postfix) with SMTP id These lines show the originating server, which I'm guessing you are not associated with at all. > 935711FA4B51 for <carlosw...@example.com>; Wed, 4 Feb 2009 07:58:58 > -0500 (EST) -Doug This email may contain confidential and privileged material for the sole use of the intended recipient and MSU-KCMS. Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.
