Google's Mail Delivery Subsystem sending DSN (Failure) caused by spams sent on my behalf

Question

I have been receiving Delivery Status Notification (Failure) e-mails from Google's Mail Delivery Subsystem ([email protected]) containing errors like this:

Delivery to the following recipient failed permanently:

lau[snip]@de[snip].com.au

----- Original message -----

X-Received: by 10.98.87.15 with SMTP id
xxxxxxxxxxxxxxxxx.xx.xxxxxxxxxxxxx;
Wed, 27 Apr 2016 04:57:09 -0700 (PDT) Return-Path:
Received: from
ipservice-092-209-025-061.092.209.pools.vodafone-ip.de
(ipservice-092-209-025-061.092.209.pools.vodafone-ip.de.
[92.209.25.61])
by mx.google.com with ESMTP id
xxxxxxxxxxxxxx.xx.xxxx.xx.xx.xx.xx.xx
for ;
Wed, 27 Apr 2016 04:57:08 -0700 (PDT) Received-SPF: neutral
(google.com: 92.209.25.61 is neither permitted nor denied by domain of

Tal[snip][email protected]) client-ip=92.209.25.61;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 92.209.25.61 is neither permitted nor
denied by domain of Tal[snip][email protected])
smtp.mailfrom=Tal[snip][email protected] Received: from
www.mydomain.com ([127.0.0.1]) by AMAZONA-BAACCEE with Microsoft
SMTPSVC(7.5.7601.17514);
Wed, 27 Apr 2016 13:57:08 +0200 Date: Wed, 27 Apr 2016 13:57:08
+0200 Return-Path: Tal[snip][email protected] To:
"lau[snip]@de[snip].com.au" From: Deshawn
Talley Subject: Price list Message-ID:
X-Priority: 3
X-Mailer: PHPMailer [version 1.73] MIME-Version: 1.0 Content-Type:
multipart/mixed;
boundary="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
X-OriginalArrivalTime: 27 Apr 2016 13:57:08.9903 (UTC)
FILETIME=[40C0DFC0:01D1A068]

I use this gmail to send form responses in my website to myself via SMTP.
There is no message like this in my "Sent Mail" folder.
Should I be concerned with my account's password?
How can I stop receiving this messages and stop these bots from spamming on my behalf?

Answer 1

You should configure SPF.

The e-mail indicates that someone at Vodafone (92.209.25.61) sent a mail with a mydomain.com address as sender. This should not be allowed, since only your mailservers should be allowed to sent such mail and 92.209.25.61 is not one of them. SPF makes it possible to publish which mail servers you want to allow to sent mail from mydomain.com, using DNS records.

After you have configured that, servers that support SPF will drop the message or mark it as spam if it does not come from one of your mail servers, and you will no longer get the bounce messages.