5

I have implemented DMARC on my mailserver and for the first time I'm getting reports of an IP address trying to fake me as the email sender:

>record>
>row>
>source_ip>91.189.90.7>/source_ip>
>count>14>/count>
>policy_evaluated>
>disposition>reject>/disposition>
>dkim>fail>/dkim>
>spf>fail>/spf>
>/policy_evaluated>
>/row>
>identifiers>
>header_from>MYDOMAIN.EU>/header_from>
>/identifiers>
>auth_results>
>spf>
>domain>canonical.com>/domain>
>result>none>/result>
>/spf>
>dkim>
>domain>MYDOMAIN.EU>/domain>
>result>none>/result>
>/dkim>
>/auth_results>
>/record>

Now the odd thing is that this IP address belongs to canonical.com. And this has begun one day after I registered an account at Ubuntu One!

If I understand this correctly then the guys at Canonical have a client that has been hacked and that is trying to send spam. And it could even be that the hacked client has access to the database of newly registered users - else this wouldn't have happened one day after registering an Ubuntu One account.

If this is true then apparently Ubuntu One has been hacked, right?

  • I doubt that's the case, my first impression is that someone is forging requests to your mail server trying to pass as a valid user. However I will let more experienced folks chip in and sit idle on the court side – Purefan Sep 9 '15 at 13:47
  • 1
    Just to clarify: This IP address is not in the logs of my mailserver. – rosix Sep 9 '15 at 13:51
5

Canonical is the parent company of Ubuntu, so yes there is likely a relationship between you registering your account there and getting this alert.

I doubt a hack is what is happening, but more likely a misconfigured email client that doesn't have your DKIM key (since you never gave it to them) and they are sending from an MFROM address that doesn't match your SPF record.

They probably invented some validation or mailing list software that doesn't play well with DMARC.

  • Thanks! I read about DMARC causing trouble with mailing lists, will post on their forums to investigate further! – rosix Sep 10 '15 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.