What happened: On June 11, 2019, the web server that our church website and email is hosted on was victim of an attack that used a previously unknown vulnerability in the Exim mail server program, and was exploited for a DDoS attack. This has happened to literally thousands of servers on June 10 and 11; 80% of the servers in the US were using this specific version of Exim. The exploit, which was previously unknown, allowed malware to run on an otherwise secure server. Major systems such as Ancestry.com and WordPress.com were also affected. For a brief period (about 15 minutes) this server was spewing spam emails that were part of a Distributed Denial of Service (DDoS) attack. The problem was immediately noted and the server shut down. We migrated all files to a new server with patched Exim and higher security settings. Unfortunately, that brief period caused Gmail and some other systems to flag our IP number as a possible source of spam. Since then, many Gmail customers have reported that emails from the church are flagged as spam. Intervention by the end user is required to have the emails recognized as legitimate.
