Can anyone spoof my Email address with mailgun if I'm using it?

Question

I'm using mailgun as kind of a sandbox for my personal/portfolio site. I've got all the required and optional records, including an SPF record allowing mailgun.org origin emails.

I recently got an email from my own address that's clearly spoofed. But gmail (I forward all emails to my gmail) didn't catch it as spam. I don't entirely know what I'm doing, but it looks like the origin is mxa.mailgun.org.

So my question is, does using mailgun expose me to potential spoofing from spammers also using mailgun?

Answer 1

Having SPF records on a domain does not prevent the receiving of spam it simply helps servers make decisions. There is no way to prevent spoofing through DKIM, Domain Key or SPF records.

The reason you received that email is a few possibilities but not limited too:

• A non-blacklisted IP sender
• Unique content within the email

Google, Hotmail, cPanel, Yahoo, Aol and all the other email providers use anti-spam but they are setup to 'learn' what spam is and what is not. By default most will accept spoofed email, this is because often websites will send emails without these additional domain records, it only becomes an issue when:

1. Emails sent to contain the same or similar content to multiple recipients.
2. If too many emails are being sent within a given time period.
3. Content that looks spammy.
4. If the end user flags the email as spam.

So while you may have received it, if they tried the same stuff on a larger scale, they would be quickly marked as spam. To prevent such emails, mark the email as spam within the Gmail dashboard, that will tell their email servers to do further checks for other users.

It could also be possible that you have received emails in the past from this domain so therefore Google does less checks. Spoof emailed always appeared as 'Send by X on behalf of Y' and there is no way to prevent it 100%, its a phished and it's not your responsibility to worry about it.

Answer 2

You can use DMARC to prevent spoofed emails from your domain.

Having a strict policy will prevent spoofing of emails from your address to most major email providers, including Gmail (email providers can in theory choose to ignore the DMARC record, but in practice almost everyone honors it). DMARC is not something that gets configured in Mailgun's interface, it is a DNS record you add to your domain.

Here is an example of a simple DMARC record (a DNS TXT record) that will strictly enforce your SPF and DKIM records. Be absolutely sure that your SPF and DKIM records allow email from all the email servers you are using, or else this policy will tell the receiving email providers to silently reject legitimate email from your address:

v=DMARC1;p=reject;pct=100

There are also ways to test your DMARC record in production before it goes fully live and starts blocking emails, but that's beyond the scope of this answer. See here for more details:

https://www.sonicwall.com/en-us/support/knowledge-base/170504796167071