0

I have set the SPF record for my domain powered by Google Apps. I followed the steps here .

But even after setting the SPF record, spam mails are being sent from the domain. What am I missing?

2
  • 3
    SPF records don't prevent your server from being used to send spam. They just give the recipient server information to act (or not) upon.
    – joeqwerty
    Mar 31, 2016 at 4:36
  • Do you have email headers you can share of those spam samples ?
    – Marco
    Mar 31, 2016 at 6:48

2 Answers 2

3

Adding a SPF record does not stop others from using your domain name to send spam, it simply allows the receiving server to check if the server that sends the email is authorized to do so or not.

Even if the server checks the spf record and finds the sending not to be authorized, it might still allow the email based on the local configuration.

EDIT: you can also look into "DomainKeys Identified Mail (DKIM)" (https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail | https://support.google.com/a/answer/174124?hl=en)

2

Spam mails can either be sent from an authorized server (usually because some authorized user has been infected or the account is compromised otherwise) or by non-authorized servers forging the domain name. You need to obtain examples of headers of the spam sent "from your domain" to determine which is the case.

SPF will protect recipients from spam sent from non-authorized servers forging a domain name protected by SPF. In itself it doesn't really stop spammers from trying to send the spam, and people whose servers do not check SPF are not protected.

3
  • The email ids are not authorized and have not been created ever on Google Apps. So I am assuming they are just using a return address for my domain. Is there any way to stop it? Mar 31, 2016 at 5:04
  • 1
    @lostInTransit Anyone can send email claiming to be anyone. No you can't stop it. You can help receiving servers identify such spam by using SPF (on all your domains), DKIM (on all outgoing email), and DMARC to advertise your policy. SPF is most effective if you use '-all' policy.
    – BillThor
    Mar 31, 2016 at 13:29
  • Don't "assume". You know spam is sent presumably because people complain, they should provide headers, with the headers one can see if the mail actually come from Google's servers or not. "email ids" being authorized or not doesn't enter into the equation for the moment, since you cannot be certain about the source e-mail address without looking at the headers (I'm not sure to which point an authorized user can muck around with his own headers when using plain SMTP AUTH to gmail's MSA port).
    – Law29
    Mar 31, 2016 at 16:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .