I have a Google Apps account set up for one of my domains. Wildcard email delivery is enabled on this domain for all emails (ie. email@example.com passes emails along to firstname.lastname@example.org), and the records related to email delivery are configured as follows (to the best of my knowledge, configured to Google's recommendations):
MX: ASPMX.L.GOOGLE.COM with priority 10 TXT: v=spf1 include:_spf.google.com ~all TXT: v=DKIM1; k=rsa; p=xxxxxxxxxxxxxxxxxxxxxxxxx
Recently, however, I have begun to receive an increased number of bounces/"out of office" emails from people who are apparently being spammed with people using email addresses from my domain. From the bounces, some headers:
Return-Path: <0379E403@domain.com> Received-SPF: softfail (google.com: domain of transitioning 0379E403@domain.com does not designate 220.127.116.11 as permitted sender) client-ip=18.104.22.168; Authentication-Results: gmr-mx.google.com; spf=softfail (google.com: domain of transitioning 0379E403@domain.com does not designate 22.214.171.124 as permitted sender) smtp.mail=0379E403@domain.com From: "Secure.Message" <0379E403@domain.com> To: <email@example.com>
(I can provide additional headers if needed.)
I looked into softfails but am not completely sure I understand it. I do wildcard emails to the domain so simply disabling wildcarding would probably not be a solution. Because emails to this domain are then forwarded on to a different email address (also within Google Apps, though), I would preferably also need to be able to send emails using Google's "send email as" ("on behalf of") feature.
Any ideas what to do now? Most importantly I am concerned about the reputation of my domain; I would very much want to keep it off of any spam lists.