A spammer is using my domain to send spam, and I'm receiving a large amount of bounced email.
I have an SPF record on the domain, however it doesn't appear to be having any effect. Receiving MTA's seem to be claiming my domain is neutral about all sending ips.
My SPF Record is:
v=spf1 include:_spf.google.com -all
(The domain is foomatic.net)
And as an example, one bounced email contained the following SPF message
Received-SPF: neutral (foomatic.net: domain of email@example.com is neutral about designating 220.127.116.11 as permitted sender)
Can anyone shed some light as to why this SPF record isn't working correctly?
(The full email header is below)
Return-Path: <firstname.lastname@example.org> X-YahooFilteredBulk: 18.104.22.168 X-Originating-IP: [22.214.171.124] Received-SPF: neutral (foomatic.net: domain of email@example.com is neutral about designating 126.96.36.199 as permitted sender) Authentication-Results: mta524.mail.kks.yahoo.co.jp from=foomatic.net; domainkeys=neutral (no sig) Received: from 188.8.131.52 (HELO foomatic.net) (184.108.40.206) by mta524.mail.kks.yahoo.co.jp with SMTP; Fri, 24 Sep 2010 05:07:52 +0900 Received: from unknown (220.127.116.11) by mtu23.bigping.com with NNFMP; Thu, 23 Sep 2010 22:51:22 +0200 Received: from rly04.hottestmile.com ([Thu, 23 Sep 2010 22:43:07 +0200]) by qrx.quickslick.com with LOCAL; Thu, 23 Sep 2010 22:43:07 +0200 Received: from [18.104.22.168] by public.micromail.com.au with QMQP; Thu, 23 Sep 2010 22:34:49 +0200 Message-ID: <497DB50E.4021779C@foomatic.net> Date: Thu, 23 Sep 2010 22:22:19 +0200 From: "Ella" <firstname.lastname@example.org> MIME-Version: 1.0 To: <email@example.com> Subject: ready 4 u Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit