I have implemented DMARC on my mailserver and for the first time I'm getting reports of an IP address trying to fake me as the email sender:
>record> >row> >source_ip>18.104.22.168>/source_ip> >count>14>/count> >policy_evaluated> >disposition>reject>/disposition> >dkim>fail>/dkim> >spf>fail>/spf> >/policy_evaluated> >/row> >identifiers> >header_from>MYDOMAIN.EU>/header_from> >/identifiers> >auth_results> >spf> >domain>canonical.com>/domain> >result>none>/result> >/spf> >dkim> >domain>MYDOMAIN.EU>/domain> >result>none>/result> >/dkim> >/auth_results> >/record>
Now the odd thing is that this IP address belongs to canonical.com. And this has begun one day after I registered an account at Ubuntu One!
If I understand this correctly then the guys at Canonical have a client that has been hacked and that is trying to send spam. And it could even be that the hacked client has access to the database of newly registered users - else this wouldn't have happened one day after registering an Ubuntu One account.
If this is true then apparently Ubuntu One has been hacked, right?