Receiving SPAM emails from Fake Internal email addresses.

Can someone please point me in the direction to prevent this please?

Scan from a Xerox WorkCentre
Incoming Fax

Please download the document. It was scanned and sent to you using a Xerox multifunction device.

File Type: pdf
Download: Scanned from a Xerox multi~7.pdf

multifunction device Location: machine location not set Device Name: Xerox0923

For more information on Xerox products and solutions, please visit

Received this morning.

We have No Fax Machine
No Xerox Machines
and No email address “Incoming.fax7”

How do I set the SMTP server to only allow to send from those addresses created?

Thanks for your time.

With so limited information you’re giving you will not get many answers…
Start by looking at the email headers… and then follow the guides for configuring the servers’ restrictions…

Return-Path: X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on X-Spam-Level: *** X-Spam-Status: No, score=3.5 required=5.0 tests=RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_BRBL_LASTEXT,RCVD_IN_SORBS_WEB,T_TVD_MIME_NO_HEADERS,URIBL_BLOCKED autolearn=no version=3.3.1 X-Original-To: Delivered-To: Received: from ( []) by (Postfix) with ESMTP id 5A0DA2A0C44; Tue, 29 Oct 2013 09:44:12 +0000 (GMT) Received: from ( by ( with Microsoft SMTP Server (TLS) id JJ0WFB1D; Tue, 29 Oct 2013 17:43:31 +0800 Received: from ( by ( with Microsoft SMTP Server id XXSTGAV5; Tue, 29 Oct 2013 17:43:31 +0800 Date: Tue, 29 Oct 2013 17:43:31 +0800 From: "Incoming Fax" X-MS-Has-Attach: yes X-MS-Exchange-Organization-SCL: -1 X-MS-TNEF-Correlator: X-MS-Exchange-Organization-AuthSource: X-MS-Exchange-Organization-AuthAs: Internal X-MS-Exchange-Organization-AuthMechanism: 04 X-MS-Exchange-Organization-AVStamp-Mailbox: MSFTFF;4;0;0 0 0 X-Priority: 3 (Normal) Message-ID: To: , Subject: Scan from a Xerox WorkCentre MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="_004_HNQ4BG15ULAQID519CZJY81XNFB08JJEQHDAOV6918AF6MCDOPAAUT0_"

We get several that say

then others that come from things like, etc. Each time is a different received from address and IP.

It’s just spam or a virus (if a PDF is attached, better do NOT click it!) that apparently got through your filters. It was actually sent from this IP:

Received: from ( []) by (Postfix) with ESMTP id 5A0DA2A0C44;

Which is a system in china: