I have been getting a lot of bounce-backs lately.

I thought my google apps account has been compromised, but there is no activity on my apps account, and there is certainly no malicious user that I can see.

Since the email is always send from some random username (eg onSecNtV1@mydomain.com), I tried to find a way of disallowing sending email from unregistered users. I couldn't find anything.

What worries me is that the message has a X-Google-DKIM-Signature, and it says "Google tried to deliver your message". Does that mean the emails are originating from my trusted clients? (I only use gmail)

AFAIK spammers are free to spoof every field of the email, but the DKIM should make the (modern) servers drop these unverifiable emails.

Any idea where the leak is?

Here's an example bounce-back:

Delivery to the following recipient failed permanently:


Technical details of permanent failure: Google tried to deliver your
message, but it was rejected by the server for the recipient domain [].

The error that the other server returned was: 553 sorry, that domain
isn't in my list of allowed rcpthosts; no valid cert for gatewaying

----- Original message -----

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=google.com; s=20120113;
X-Received: by with SMTP id b15mr4892361igk.69.1360854627245; Thu, 14 Feb 2013 07:10:27 -0800 (PST)
X-Received: by with SMTP id b15mr4892357igk.69.1360854627177; Thu, 14 Feb 2013 07:10:27 -0800 (PST)
Return-Path: <onSecNtV1@mydomain.com>
Received: from [] ([]) by mx.google.com with ESMTP id vx6si33676538igb.26.2013.; Thu, 14 Feb 2013 07:10:26 -0800 (PST)
Received-SPF: neutral (google.com: is neither permitted nor denied by best guess record for domain of onSecNtV1@mydomain.com) client-ip=;
Authentication-Results: mx.google.com; spf=neutral (google.com: is neither permitted nor denied by best guess record for domain of onSecNtV1@mydomain.com) smtp.mail=onSecNtV1@mydomain.com
MIME-Version: 1.0
Date: Thu, 14 Feb 2013 20:40:29 +0530
Message-ID: <B23FC935D84FBB6D39DD9BDCC44CD2.176.3699432888759@D>
From: "Valetine's Day" <onSecNtV1@mydomain.com>
To: spoonbillzi7@etisbew.com
Subject: I will be excited if you are my Valetine
Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: 8bit
List-Unsubscribe: <mailto:E7E740C2663A5B2B9D18@missinyou.com>
X-Gm-Message-State: ALoCoQkVcAw4pG/8g2x1C02KHf4lLkBdJ4iLe9r1ZeGlGE1AwtZEQm5VsHh9tNmG04yH2ahWqXnIiKu7DrTf7j6bLHEaF0l0AMhrC6ZvnyJTUr4n+9TKMieQPycP0Pw8sCJ8DELiMNlLI/CGbgQ1ObMLghXauZTeqg==

----- End of message -----

Ensure you don't have catch-all address enabled for your Apps account, otherwise you'll be getting tons of random stuff. http://support.google.com/a/bin/answer.py?hl=en&answer=33962

Don't worry about X-Google-DKIM-Signature (or any other headers prepended with X- in general), this one is Gmail specific and it is not a real DKIM signature for your domain. If you want to set up one, review the following article: http://support.google.com/a/bin/answer.py?hl=en&answer=174124

  • 1
    You're correct. The X-Google-DKIM-Signature is contained in all gmail/apps emails. There is a separate DKIM-Signature header for my own DKIM. So overall I guess it's not my fault as the recipient should have dropped the message. – Sam Feb 19 '13 at 14:26

The rejection is not related to DKIM but to the recipient. But why should Google mail servers try to deliver to wrong MXs? Doesn't make sense to me. The recipient system could be incorrectly configured, of course. Do the failing recipient addresses have the same MX?

Something else: Have you verified the DKIM signature? Maybe it's just some technical looking text...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.