Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a suspicion that somebody is sending spam from my domain. Today I received an email from postmaster(AT)halliburton.com to htuwxjw(AT)example.com which said:

The following email was blocked because it contained an attached file type that is prohibited by the Halliburton email gateway:

Sender: htuwxjw(AT)example.com
Subject: ATTN: Important notification for a Visa / MasterCard holder!

htuwxjw(AT)example.com does not exist. I have a catch-all email which receives any email sent to @example.com.

Is there anything I can do to prevent this? I have this TXT record on example.com: (MX records are Google's)

v=spf1 a mx ?all

I'm worried that any emails I send will be blacklisted if this person keeps sending emails as if they're from my domain.

share|improve this question
up vote 4 down vote accepted

The ideal way to do this is to send a hard fail on email that isn't coming from your server IP address or your specified MX record by doing this:

v=spf1 +a +mx -all

This however will not stop the email from being sent. Spam filters do various checks on an email that has been sent out, one of them will be a check on the SPF record of the domain it is supposed to have come from and compare this to the IP address/MX record this has come from. This is one way to prevent and help disavow people sending emails pretending to be you but it will not put a complete stop to it. In a way this will make sure that the your domain is safe. Normally however it is the IP address that it is sent from that gets blacklisted.

Just a quick addition. You would probably be better using

v=spf1 +a +mx ~all
  • - is a hard fail and may cause delivery problems
  • ~ is a soft fail which shouldn't cause delivery issues (in case of a false positive however this is very low risk)
  • if you do get stuck you could always try a wizard to do this for you. Try here
  • Hard Fail is recommended as it will turn away all that do not match where as a soft fail will just flag the mail and let it through
  • +mx and +a is the same as using just a and mx

I personally do use the hard fail but some people do experience issues with this.

share|improve this answer
I saw your comment, thanks for expanding it into an answer. If I could ask for a little more :) in what cases might the hard fail cause delivery problems? – andrewtweber Feb 6 '14 at 16:48
I've updated my answer, i beleive its incase of false positives however this is rate is very low with the rejection from SPF records. I would use a hard fail. Also i updated the difference between +a and a, which is not much – Liam Sorsby Feb 6 '14 at 16:53
also make sure you wait for the dns to propergate before you try it out – Liam Sorsby Feb 6 '14 at 16:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.