2

I just received an email from [email protected] to [email protected] which was caught by my catch-all and emailed to me.

Below are the headers for the email which show that it was sent from 191.185.233.11 but somehow through my webmail IP 185.116.214.97

My SPF record is v=spf1 a mx ip4:185.116.214.97 -all which should work so HOW in the world was this possible??

Return-Path: <[email protected]>
Received: from server.primahc.com (server.primahc.com [185.116.214.97])
    by mtaig-mac03.mx.aol.com (Internet Inbound) with ESMTP id 6509B700000A1
    for <[email protected]>; Mon, 30 May 2016 17:54:08 -0400 (EDT)
Received: from ([191.185.233.11]) for <[email protected]> with MailEnable Catch-All Filter; Mon, 30 May 2016 22:54:05 +0100
Received: from bfb9e90b.virtua.com.br ([191.185.233.11]) by primahc.com with MailEnable ESMTP; Mon, 30 May 2016 22:54:04 +0100
Message-ID: <[email protected]>
From: <[email protected]>
To: <[email protected]>
1
  • 1
    You haven't shown us the envelope-From, only the header From:. SPF has nothing to say about the header From:, so we can pass no comment on that. You need to look in your mail logs to see what MAIL FROM address was given at delivery time.
    – MadHatter
    May 30, 2016 at 22:40

3 Answers 3

6

That means that your MTA is not set to reject mail based on SPF failure or that it only does so with the proper _dmarc record.

DMARC is intended to complete SPF records to define how to treat them.

Note that DKIM validation and signature would prove to be an even more effective security measure, although it generates a bit of overhead on all sides.

2
  • So I need to setup DMARC?
    – Shivam Paw
    May 30, 2016 at 23:10
  • DMARC is what defines how you want MTAs deal with your SPF failures. You also need to make sure your MTA follows DMARC and SPF rules to reject the messages. May 30, 2016 at 23:11
4

SPF is not a magic bullet that will prevent this. At its core, it's just a hint for the mail server about where mails allegedly coming from this domain should originate from and a mail server can do anything in between outright ignoring it, using it as a contributing factor in a spam filter or following it to the letter. How is your mail server configured to handle SPF?

1
  • It is setup as Plesk sets it up. How can I check that?
    – Shivam Paw
    May 30, 2016 at 23:09
2

Looking over the information you posted, your MX and A record are both 85.116.214.97, so your SPF is a little overkill. You can simplify it to just v=spf1 mx -all

I looked at your contact us page on your website, I'm guessing this is where the Feedback is sent from? Based on the headers you provided, it looks like it might be possible to send emails to other people through your contact us screen. If you post the code for that section, we can see if that's what's being abused.

I did run your IP through a blacklist scanner - They are clean, which is good news, a lot of times if a server is being abused you'll show up on a few lists.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .