Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I received a phishing email this morning that appeared to come from one of my addresses to itself.

Looking at the headers, I found something interesting.

DomainKey-Status: no signature
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
    mydomain.com
X-Spam-Level: 
X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_00,HTML_MESSAGE,
    HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,MISSING_MID,SPF_PASS autolearn=no
    version=3.2.5
Received: (qmail 10412 invoked by uid 110); 6 Aug 2012 09:59:17 -0400
Delivered-To: 18-bdstrainers@anotherOfMyDomains.net
DomainKey-Status: no signature
Received: (qmail 10390 invoked by uid 110); 6 Aug 2012 09:59:17 -0400
Delivered-To: 34-info@yetAnotherOfMyDomains.com
DomainKey-Status: no signature
Received: (qmail 10373 invoked from network); 6 Aug 2012 09:59:15 -0400
Received-SPF: pass (mydomain.com: domain of surewest.com designates 212.61.84.249 as permitted sender) client-ip=212.61.84.249; envelope-from=visualsx@surewest.com; helo=d84249.iae.nl;
Received: from d84249.iae.nl (212.61.84.249)
  by yetAnotherOfMyDomains.com with SMTP; 6 Aug 2012 09:59:14 -0400
Date: Mon, 6 Aug 2012 14:27:38 +0100
From: <info@yetAnotherOfMyDomains.com>
To: <info@yetAnotherOfMyDomains.com>
Subject: Your Federal Tax Payment ID: 8716780 is failed
X-Mailer: foljo
MIME-Version: 1.0
Content-Type: text/html;
charset=Windows-1252
Content-Transfer-Encoding: 7bit

Ok, so first off, 212.61.84.249 is an IP in Nederlands, and if you visit the IP you get a LaCie login page.

Next the domain surewest.com, is digitalTV/ISP in the mid US.

but what gets me is this line in particular:

Received-SPF: pass (mydomain.com: domain of surewest.com designates 212.61.84.249 as permitted sender) client-ip=212.61.84.249; envelope-from=visualsx@surewest.com; helo=d84249.iae.nl

My SPF record is set correctly on my server, so;

HOW in the world did they spoof a valid SPF on surewest.com for MY domain which is NOT on surewest?

What can I do to keep this from happening again?

share|improve this question
2  
If I check the SPF record for surewest.com, it has +all in it which will allow anything. –  Eric Aug 6 '12 at 15:45

1 Answer 1

up vote 9 down vote accepted

Your SPF record designates everyone in the world as an allowed sender:

"v=spf1 mx:... +all"

The +all is the important part, + means "allowed" and all really means "the whole internet". They didn't need to spoof anything, their mail is valid according to your SPF record. Try -all instead.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.