I just got an email from some random person's name "via" email@example.com, although firstname.lastname@example.org is just a distribution group within G Suite.
We have an up-to-date SPF record added from Google, and I'm not quite sure what or how another person is able to send an email via my domain.
Here are some references from the message source, without giving any specific information to my domain or the receipients:
Date: Mon, 01 Apr 2019 23:41:44 -0500 Subject: Mass Shootings orchestrated to pass gun control for the Federal Reserve Shareholders planned U.S. Holocaust- How can your industry help? From: 'Random Person' via Info <email@example.com> <snipped> Message-ID: <firstname.lastname@example.org> Thread-Topic: Mass Shootings orchestrated to pass gun control for the Federal Reserve Shareholders planned U.S. Holocaust- How can your industry help? Thread-Index: AWY0NTc5UrmPA22gl2edULFwYvLC7TIwMTU5 References: <email@example.com> Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3637013229_1574776269"
All of our users have 2FA enabled, although I don't think that's relevant here. This is clearly a spoofed emailed as firstname.lastname@example.org is not a registered account within the domain (just verified it).
Any ideas how this may have happened and how to prevent it?
Also, this message doesn't seem to contain any valuable information other than it was potentially leveraging Yahoo to send email on "behalf" of my domain, which I'm not quite sure how that worked.