Access Keys:
Skip to content (Access Key - 0)

Why does this spam message say it came from me?

The "From" address in email is comparable to the return address on a piece of snail mail. It can be set to whatever the sender desires, and is not necessarily accurate. Just as you could write "1600 Pennsylvania Ave, Washington, DC" on a letter and drop it in the mail, a spammer can set the "From" address to be whatever they want.

Spam, including virus spam, often forges the "From" header in email so that it appears to be coming from someone who has no relation to the mail itself. Often, viruses will pick a random address in the address book of an infected user, set that as the "From" address of the mail, and then pick another random address to send the message to.

These messages should generally simply be ignored. Replying to the sender is not useful, since it is likely forged. The same applies for bounce messages that claim you sent spam to someone else. A virus likely set your email address as the "From" line, and the recipient's mail server sent mail to you to tell you this, even though this is useless.

If you know the spam or virus is coming from an MIT machine (as indicated in the headers by the originating host, NOT the sender's email address), you can forward the message, without attachments, to with a note indicating this. Be sure to include the full headers of the message. Network Security will then look into it and inform the owner of the infected machine, and possibly disable network service to the machine.

For information on how to view and forward your full mail headers, see: Q: Forwarding Full Mail Headers

IS&T Contributions

Documentation and information provided by IS&T staff members

Last Modified:

May 13, 2012

Get Help

Request help
from the Help Desk
Report a security incident
to the Security Team
olc-mail olc-mail Delete
Enter labels to add to this page:
Please wait 
Looking for a label? Just start typing.
This product/service is:
Easy to use
Difficult to use

This article is:
Adaptavist Theme Builder (4.2.3) Powered by Atlassian Confluence 3.5.13, the Enterprise Wiki