Spammers pretending to email from my domain

Forums › IT Pro and developers › Spammers pretending to email from my domain

1 | 2

Zeon

3876 posts

Uber Geek

Trusted

#810878 3-May-2013 15:29

SPF is the answer!

Speedtest 2019-10-14

GoodSync

GoodSync. Easily back up and sync your files with GoodSync. Simple and secure file backup and synchronisation software will ensure that your files are never lost (affiliate link).

kyhwana2

2553 posts

Uber Geek

#810987 3-May-2013 19:52

craft1: Here is the contents of one of the many emails I have received so far, not sure exactly how to read it as far as if it sates where it came from, etc...

---------------

Received-SPF: none (domain of fnd.co.nz does not designate permitted sender hosts)

Authentication-Results: mta1268.mail.bf1.yahoo.com from=fnd.co.nz; domainkeys=neutral (no sig); from=fnd.co.nz; dkim=neutral (no sig)

You don't have SPF records or DKIM/domainkeys on your domain. You should get that sorted out as well.

craft1

77 posts

Master Geek

#811785 5-May-2013 22:12

I have now created an SPF record. Hopefully the syntax is correct, looks ok from what I can tell.

v=spf1 mx include:smtp.secureserver.net include:smtp.xtra.co.nz -all

So that should let me use the godaddy smtp server and also my ISP's server.

Thanks for everyone's help here.

JamesCairns

17 posts

Geek

#811829 6-May-2013 05:33

An SPF record might help a bit with your issue although working out an SPF record can be fairly tricky if you have not done so before.

This website might help with SPF syntax http://www.openspf.org/SPF_Record_Syntax

You will most likely need to add your SPF as a TXT record on your authoritative DNS

You can test your SPF is correct here: http://www.kitterman.com/spf/validate.html

I find that using the following is usually pretty good.

v=spf1 a mx ip4:Your.Server.ip.address -all (make sure you change Your.Server.ip.address)

You have to remember this will not prevent anybody sending email using your domain name however it will help other mail servers block out unwanted junk and to treat your email as legitimate from you.

PaulBrislen

198 posts

Master Geek

Trusted

#811870 6-May-2013 09:10

Sadly this is the downside of owning your own domain... I get these too, albeit on a smaller scale. I was getting all the bounce messages to the point where my inbox was useless.

I set my own email to reject any coming in to none "paul@..." and that cleaned them all out so I could see again, but I've lost some functionality as a result.

dirty spammers.

mattwnz

19388 posts

Uber Geek

#812165 6-May-2013 17:36

PaulBrislen: Sadly this is the downside of owning your own domain... I get these too, albeit on a smaller scale. I was getting all the bounce messages to the point where my inbox was useless.

I set my own email to reject any coming in to none "paul@..." and that cleaned them all out so I could see again, but I've lost some functionality as a result.

dirty spammers.

You shouldn't lose any functionally. You just make sure that your domain doesn't have any catchalls setup, and set it to either blackhole or bounce the, Having a domain email account shouldn't put you in any worse position from using any other email account, as long as you are using a good quality email host, with good quality spam protection.

PaulBrislen

198 posts

Master Geek

Trusted

#812168 6-May-2013 17:45

mattwnz:
PaulBrislen: Sadly this is the downside of owning your own domain... I get these too, albeit on a smaller scale. I was getting all the bounce messages to the point where my inbox was useless.

I set my own email to reject any coming in to none "paul@..." and that cleaned them all out so I could see again, but I've lost some functionality as a result.

dirty spammers.

You shouldn't lose any functionally. You just make sure that your domain doesn't have any catchalls setup, and set it to either blackhole or bounce the, Having a domain email account shouldn't put you in any worse position from using any other email account, as long as you are using a good quality email host, with good quality spam protection.

Sadly I had been using "fake" email addresses to register for stuff so as to make spotting spammers easier... so to sign up for Geekzone, for example I would have used geekzone@...co.nz and then if spam came into that account I would know where the address came from.

That all goes out the window if you block any non-paul address.

Other than that, which was only painful briefly, it's been easy.

freitasm

BDFL - Memuneh
76381 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#812170 6-May-2013 17:53

PaulBrislen: Sadly I had been using "fake" email addresses to register for stuff so as to make spotting spammers easier... so to sign up for Geekzone, for example I would have used geekzone@...co.nz and then if spam came into that account I would know where the address came from.

This is also a false security thing. If your PC is compromised with some spyware or adware and you receive an email from Geekzone that piece of "Software" might harvest the address, because it is in the inbox so it's automatically valid.

Next thing you know you get spam sent to "geekzone@...co.nz" that was not sent from us and neither our database leaked.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

PaulBrislen

198 posts

Master Geek

Trusted

#812178 6-May-2013 18:04

freitasm:
PaulBrislen: Sadly I had been using "fake" email addresses to register for stuff so as to make spotting spammers easier... so to sign up for Geekzone, for example I would have used geekzone@...co.nz and then if spam came into that account I would know where the address came from.

This is also a false security thing. If your PC is compromised with some spyware or adware and you receive an email from Geekzone that piece of "Software" might harvest the address, because it is in the inbox so it's automatically valid.

Next thing you know you get spam sent to "geekzone@...co.nz" that was not sent from us and neither our database leaked.

But by then I'd have put out a press release condemning you in the highest court in the land (mainstream media) so that would be OK.

but I jest.

Yes, there are limitations to this approach and it's surely not a one-size-fits-all but it's remarkably good for understanding who the ratbags are. I only used it with one-time sign-ups, and if my account were compromised I'd hope I'd see the broad effects before calling my press conference.

craft1

77 posts

Master Geek

#812281 6-May-2013 20:33

I'm trying to keep my catch-all on the domain also as I do the same thing with personalised addresses for websites I don't want to share my actual email address with. Geekzone isn't one of them obviously but there are quite a few of them. In the meantime I'll just ignore my info@... address.

1 | 2