1

I have received a threatening message in my email [email protected] from my other email address [email protected]. Note that [email protected] is an alias to [email protected]. Also, of course, I own mydomain.com and it is registered in Google Domains. Message says my address [email protected] has been hacked and I want to find out if it's true.

Email went to spam. After inspecting email headers, I see SPF result is "neutral". I see here that it is possible to configure Gmail to send emails using alias addresses. I have never configured it, though.

First question Since primary address is managed by Google/Gmail and mydomain.com is registered also in Google (Domains), shouldn't SPF result be "pass"?

Second question Attacker says "I managed to log in to your email account [email protected]". Does it make sense? Is it even possible to login using an alias? Should I just assume it is a scam and ignore right now the message?

2
  • "Is it even possible to login using an alias?" - why don't you just try? "Should I just assume it is a scam" - very likely, this is a standard pattern of mails, including the faked sender. "shouldn't SPF result be "pass"" - impossible to say without knowing the SPF record for your domain and the IP address of the sender. Commented Oct 20, 2023 at 10:06
  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer.
    – Community Bot
    Commented Oct 20, 2023 at 12:02

2 Answers 2

1

SPF neutral is not informative (it's the same as not having SPF at all). You need SPF to pass for DMARC, which is supposed be the only valid use of SPF (though SPF sadly continues to be misused). SPF is dangerous because in order for your Gmail-originating email to pass, you need to allow all Google's whole IP range (328,960 in IPv4 and 29,710,560,942,849,126,597,578,981,376 in IPv6); anybody with SMTP outbound access from those IPs can send mail as you. (Google tries to limit this, but that's still a very large surface.)

A better solution would be to set up DKIM for your domain and keep SPF as neutral (or better yet, set up an SPF record of v=spf1 ?all to fully disable it). Set up a DMARC record to get reports that will show you what you might have missed. Add servers you completely control to SPF if you don't want to set up DKIM on them. (The Google Support link you shared does, sadly, note that you cannot DKIM-sign with your forwarded domain. You'll need another service to do that, e.g. Google Workplace as noted on that page.)

If you still want to rely on SPF and want help troubleshooting your record and what does or does not pass, you'll have to actually post your SPF record for review.

Your second question refers to something an attacker sent you, which means you have no indication that it's accurate. That said, it might be referring to SPF bypassing through forwarders ("email forwarder" is a better term than "alias", especially when the message passes over the public internet). See Forward Pass: On the Security Implications of Email Forwarding Mechanism and Policy for more.

1

Ignore it. An alias account cannot be used to log in, so that is most likely a phishing attempt and correctly marked as spam. I suggest changing your password anyway as a precaution. https://support.google.com/a/answer/33327?hl=en#:~:text=Email%20aliases%20are%20not%20Google,Google%20Account%20in%20your%20organization.

Also, do not follow the advice of the post that says to disable SPF. I recommend to read the article below and hire a professional to review your email setup, but study the topic first in order to ask relevant questions and understand the answers. https://sendgrid.com/en-us/blog/gmail-yahoo-sender-requirements

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .