TOPIC:

The admin email listed on our club website was sent a spam email that appears to have gone through the toastmastersclubs.org mail server. Here are the message headers:

It doesn't appear that it was sent through the website, as messages sent that way haveas the first relay entry (i.e. at the bottom of the header). Regardless, we've changed our admin password for the FreeToastHost site.

I'd be curious to know if something has indeed been compromised and, if so, what.

Sincerely,

Maureen
Club 4431485

1) we do not filter the officer individual email alias or the admin alias.
2) the source of the email was Received: ⁨from the emaill server at ms11p00im-qufv17080701.me.com ([17.58.36.61])

It is important to understand that *all* club email addresses go through the FTH server. That how the system forwards email lists and officer emails to the correct people. People send an email to a club email address which is handled by the FTH server, and it figures out the correct person to forward the email to from your website settings and membership management info. This is why the emails look to come from the FTH server (because they were forwarded from it)--we cannot change this because email clients would flag the emails as phishing emails otherwise.

This is how the system has always worked (and likely always will). We limit the amount of spam by designating some email addresses as publicly accessible and some as only accessible by club members (or officers in some cases). Most publicly accessible email addresses can be disabled, but the admin email address cannot be disabled or made "members only".

We designate the admin email address as *always* publicly accessible so that there is at least one publicly accessible email address for each and every club. However, this can create a problem with this email address being targeted for spam, particularly since it is a documented email address.

In your situation, it looks like someone is trying to spam you via the admin email address. If you have enabled the "Is this SPAM?" links in emails to public email addresses, you should just be able to click the link at the bottom of the email body to block the senders email address (listed in the Reply-To section) in the future. If you did *not* enable the "Is this SPAM?" links, then you can add the senders email address (This email address is being protected from spambots. You need JavaScript enabled to view it.) to your club email Black List (in the Email and Contact Forms module).

Reference the following doc: support.toastmastersclubs.org/doc/item/email-and-contact-forms

OK, I understand now. For some reason I didn't think of the fact that using the alias would necessitate going through the mail server. Sorry for the false alarm, but thank you for the responses!