Top Three Reasons Spam Looks Like It’s From Your Domain
Quick Answer
When your customers and staff receive spam that appears to come from your own domain, three causes account for almost all of it. First, missing or weak SPF: attackers spoof your From header because there is no SPF record telling receivers which IPs are authorized to send for your domain. Publish v=spf1 with includes for your real senders (Microsoft 365, Google Workspace, ESPs) and a -all hard fail. Second, no DKIM signing: even with SPF, attackers using forwarded or relayed paths can pass SPF; DKIM cryptographically signs outbound mail with your domain's key so receivers can verify authenticity. Third, no DMARC at enforcement: without DMARC at p=quarantine or p=reject, receivers fall back to lenient defaults and let suspicious mail through. The fix is the SPF/DKIM/DMARC stack at full enforcement, plus aggregate-report monitoring to catch new sending sources. Inbound filtering on its own does not stop your domain from being spoofed at other people's mailboxes.
We have a few clients complaining about spam that appears to be coming from their own domain.
We have investigated the issue with multiple customers and we have discovered the three most common reasons why these junk messages that appear to be from their own domain are getting delivered to your mail servers.
There are three common reasons:
- ****SPF Records – This is the number 1 reason that bad mail gets through.
****Please ensure that you have an SPF record published for your domain. http://www.kitterman.com/spf/validate.html is a great site to check your current SPF records.Ideally your SPF should contain the IP addresses of your corporate, outbound or other mail servers that you utilize to SEND outbound email. Once you have this information you’ll need to update your SPF records with your DNS provider.Once this is in place your SPF records instructs the DuoCircle Inbound Filter how to handle mail that appear to come from your domain, but does not originate from **your servers. Ideally we would drop these messages and mark them as spam.
****a) If you use DuoCircle for outbound SMTP our SPF instructions are here. https://support.duocircle.com/support/solutions/articles/5000519471-how-do-i-use-spf-
**b) If you use your own servers you’ll have to do some investigations to get SPF working correctly. This can typically be provided by your ISP or your IT Admin. - Whitelists – You have added your company’s domain name to the WHITELIST in the DuoCircle customer portal. Doing this will skip any inspection rules. And because we have specifically been instructed to whitelist all emails, these nefarious emails will get delivered to your inbox. By default your own domain is not whitelisted.Viruses are being blocked, but the rest will be delivered because of whitelisting. Here is the information on checking your filtering rules – https://support.duocircle.com/support/solutions/articles/5000554833-email-filter-rule-examples (My advice, unless you need specific rules, it’s best to leave the whitelists alone)
- ****Unprotected SMTP Ports / Backup MX – Some customers still have mail.domain.com configured in DNS even though they are using our filtering service.****Spammers are smart and they are are connecting to mail servers directly, ignoring MX records and bypassing our filtering. In this situation you can either Firewall your server and only accept email from DuoCircle, Change your Delivery Port or update your dns.
a) You’ll know if this is the reason that the junk is being processed if you look at the headers and there are no references to Mailhop.org in the transaction.
b) Here is a list of our IP’s for your firewall – https://support.duocircle.com/support/solutions/articles/5000524218-ip-addresses-for-firewalls
c) The other reason is backup MX services that don’t do spam filtering or antivirus. Your backup MX service is back door to your mail server, make sure that it’s protected and it’s filtering spam. - DMARC (Commenter Andrew mentioned this)DMARC is a more robust way to authenticate outbound emails and is fully supported by our inbound and outbound mail system. To learn more we have a solutions article https://support.duocircle.com/solution/articles/5000703263-what-is-dmarc- that can help. When you are ready to setup DKIM signing, let us know and we can help configure it with you.
General Manager
General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.
Secure your email infrastructure
Protect, authenticate, and deliver. Contact our team to find the right solution.