4

I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different domains that are saying an email I tried to send to them was rejected or couldn't be delivered. But I didn't send any emails to these addresses. The original sender address is never a real email address I have set up. I have looked through my access logs, and no out-going emails were found from my address, and no emails to them in any outbox.

So I'm guessing someone is sending emails pretending to be me. So, can someone advise me as to what the implications are, and (if possible) what i can do to prevent it?

3

The most likely culprit here is that somebody is spoofing addresses from your domain. There are a few ways that you can help remote network operators identify that the mail was likely spoofed. The main two things you can do is:

  1. Setup Sender Policy Framework (SPF) records to identify which email servers are the only authorized email servers for your domain.
  2. Setup DomainKeys Identified Mail (DKIM) to sign all your outgoing mail so remote email servers can drop mail that either not signed or has a broken signature.

Google Apps makes setting up both things really easy from an administrator standpoint.

Neither SPF or DKIM will prevent people from spoofing email from your domain, but it certainly helps prevent email server operators from processing and delivering any spoofed spammy mail.

  • Nice, I have added an SPF record to the domain, and so far, no messages, i'll give it a week before celebrating – topherg Feb 24 '14 at 17:12
  • Hmm, I am still receiving some automated responses for undeliverable mails, some of them even signed by Microsoft Exchange (seem to all be 2007). I have used several online services for SPF record testing, but they all said that it was valid. Could it be down to the target for these emails not having a properly patched system to include SPF tests? – topherg Feb 25 '14 at 15:50
  • p.s. I am using v=spf1 include:_spf.google.com ~all, although I am now trying it ... -all instead – topherg Feb 25 '14 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.