I recently registered a domain name, and set up an email account tied to it with Zoho mail. I'm concerned about making sure all emails from this domain are signed to prevent spoofing.
I've enabled SPF and DKIM on Zoho and my domain, but is this enough? For example, here's a phising email I received which is successfully spoofed with signature:
I'm confused by a couple of things:
- How is it that the "to" address is the same as the "from" address?
- How is it that the messaged is Signed by outlook.com?
How can I protect this from happening on my own domain, and how can I try sending testing-spoofs to check its security?
I've attempted using
telnet to send emails from my domain, but I receive a
553 Relaying disallowed error in reply to my
RCPT TO message. The same thing happens when testing
mx.zoho.com with the mxtoolbox SMPT diagnostics.
Related: Can I spoof email?