5

I have implemented DMARC on my mailserver and for the first time I'm getting reports of an IP address trying to fake me as the email sender:

>record>
>row>
>source_ip>91.189.90.7>/source_ip>
>count>14>/count>
>policy_evaluated>
>disposition>reject>/disposition>
>dkim>fail>/dkim>
>spf>fail>/spf>
>/policy_evaluated>
>/row>
>identifiers>
>header_from>MYDOMAIN.EU>/header_from>
>/identifiers>
>auth_results>
>spf>
>domain>canonical.com>/domain>
>result>none>/result>
>/spf>
>dkim>
>domain>MYDOMAIN.EU>/domain>
>result>none>/result>
>/dkim>
>/auth_results>
>/record>

Now the odd thing is that this IP address belongs to canonical.com. And this has begun one day after I registered an account at Ubuntu One!

If I understand this correctly then the guys at Canonical have a client that has been hacked and that is trying to send spam. And it could even be that the hacked client has access to the database of newly registered users - else this wouldn't have happened one day after registering an Ubuntu One account.

If this is true then apparently Ubuntu One has been hacked, right?

Improve this question
2
  • I doubt that's the case, my first impression is that someone is forging requests to your mail server trying to pass as a valid user. However I will let more experienced folks chip in and sit idle on the court side
    – Purefan
    Sep 9, 2015 at 13:47
  • 1
    Just to clarify: This IP address is not in the logs of my mailserver.
    – rosix
    Sep 9, 2015 at 13:51

1 Answer 1

Reset to default
5

Canonical is the parent company of Ubuntu, so yes there is likely a relationship between you registering your account there and getting this alert.

I doubt a hack is what is happening, but more likely a misconfigured email client that doesn't have your DKIM key (since you never gave it to them) and they are sending from an MFROM address that doesn't match your SPF record.

They probably invented some validation or mailing list software that doesn't play well with DMARC.

Improve this answer
1
  • Thanks! I read about DMARC causing trouble with mailing lists, will post on their forums to investigate further!
    – rosix
    Sep 10, 2015 at 7:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .