0

Ive been reviewing the emails blocked by our anti virus and have seen allot come from [email protected] (we dont have any users called this) with company.com being our domain, the emails all have the subject 'document request' and all according to our anti virus contain something (either trojan, virus, phishing etc..)

How can i prevent our domain being spoofed in this way ?

UPDATE: We are using google apps for business email. We also have an old email server from before we moved to google apps but the mx record is no longer pointed here. (its just left up as a backup copy of old emails, not sure if its even relevant but thought id mention it in case it was)

Improve this question
2
  • 1
    What kind of email are you using? (i.e., Exchange, Google for Business, Office365)
    – HashHazard
    Commented Oct 3, 2016 at 14:21
  • @Hollowproc we're using google apps for business, ive updated the question reflect this
    – sam
    Commented Oct 3, 2016 at 14:44

2 Answers 2

Reset to default
7

You can implement DMARC - https://dmarc.org/ - DMARC is a standard that allows you to specify mail servers that are valid for sending your email and contain some processes for filtering mail appropriately when it does not.

Improve this answer
3
  • 1
    I see you say you use Google Apps for Business - in that case, you're in luck, Google is one of the main pushers behind DMARC and plays nicely with it. support.google.com/a/answer/2466580?hl=en
    – crovers
    Commented Oct 3, 2016 at 14:58
  • are there pros / cons of DMARC over Domain Keys Identified mail - en.wikipedia.org/wiki/DomainKeys_Identified_Mail ? Or is it not a clean cut issue ?
    – sam
    Commented Oct 3, 2016 at 15:18
  • 1
    DMARC is a combination of DKIM + SPF (Sender Policy Framework) plus some reporting functionality, so you see when people drop your email, etc.
    – crovers
    Commented Oct 3, 2016 at 15:44
1

In addition to DMARC, if you were running your own server, you can also implement edge checks such that incoming emails have their envelopes checked to ensure that they don't claim to be from your domain.

That kind of check has been around a lot longer than DMARC. It is simple and effective. However, it can catch out people who implement cloud-based systems that send emails that deliberately (but legitimately) pretend to be from your organisation. Then you either have to whitelist or provide an authorised private relay service.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .