3

I have a suspicion that somebody is sending spam from my domain. Today I received an email from postmaster(AT)halliburton.com to htuwxjw(AT)example.com which said:

The following email was blocked because it contained an attached file type that is prohibited by the Halliburton email gateway:

Sender: htuwxjw(AT)example.com
Subject: ATTN: Important notification for a Visa / MasterCard holder!

htuwxjw(AT)example.com does not exist. I have a catch-all email which receives any email sent to @example.com.

Is there anything I can do to prevent this? I have this TXT record on example.com: (MX records are Google's)

v=spf1 a mx ?all

I'm worried that any emails I send will be blacklisted if this person keeps sending emails as if they're from my domain.

Improve this question
0

1 Answer 1

Reset to default
4

The ideal way to do this is to send a hard fail on email that isn't coming from your server IP address or your specified MX record by doing this:

v=spf1 +a +mx -all

This however will not stop the email from being sent. Spam filters do various checks on an email that has been sent out, one of them will be a check on the SPF record of the domain it is supposed to have come from and compare this to the IP address/MX record this has come from. This is one way to prevent and help disavow people sending emails pretending to be you but it will not put a complete stop to it. In a way this will make sure that the your domain is safe. Normally however it is the IP address that it is sent from that gets blacklisted.

Just a quick addition. You would probably be better using

v=spf1 +a +mx ~all
  • - is a hard fail and may cause delivery problems
  • ~ is a soft fail which shouldn't cause delivery issues (in case of a false positive however this is very low risk)
  • if you do get stuck you could always try a wizard to do this for you. Try here
  • Hard Fail is recommended as it will turn away all that do not match where as a soft fail will just flag the mail and let it through
  • +mx and +a is the same as using just a and mx

I personally do use the hard fail but some people do experience issues with this.

Improve this answer
3
  • I saw your comment, thanks for expanding it into an answer. If I could ask for a little more :) in what cases might the hard fail cause delivery problems?
    – webmain
    Feb 6, 2014 at 16:48
  • I've updated my answer, i beleive its incase of false positives however this is rate is very low with the rejection from SPF records. I would use a hard fail. Also i updated the difference between +a and a, which is not much
    – Liam Sorsby
    Feb 6, 2014 at 16:53
  • also make sure you wait for the dns to propergate before you try it out
    – Liam Sorsby
    Feb 6, 2014 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.