Since 2 months our email address gets abused by a spam bot. It turns out that emails are send via our info@ email address to thousands of recipients of which many mails bounce back and land back in our inbox.
Our domain is hosted at the German provider 1und1. I use route 53 nameservers in order to resolve the domain on heroku.
Here is my mail relevant setup at route 53:
MX Servers configured:
10 mx01.kundenserver.de 20 mx00.kundenserver.de
"v=spf1 a mx ~all"
After the first spam attempt I have setup the SPF record hoping this would solve the problem but it did not. Also according to SES statistics, it looks like the emails are not send via SES so I can also guarantee that our website is working correctly and mails are not send via the website.
It must be some other clinch which I don't know about.
How can it be that a spam bot is abusing our own email to send out spam? How can I prevent Spam mailings in the future?
Thanks for any help.
Header of one of the bounced spam emails:
--===143084232====mail.ip.ncnet.ru=== Content-Type: text/plain; charset="utf-8"
Failed to deliver to '[xxxxxxx]@platicly.com' SMTP module(domain @18.104.22.168|platicly.com) reports: platicly.com: DNS transaction timeout
--===143084232====mail.ip.ncnet.ru=== Content-Type: message/delivery-status
Reporting-MTA: dns; mail.ip.ncnet.ru
Original-Recipient: rfc822;<[xxxxxxx]@platicly.com> Final-Recipient: rfc822;<[xxxxxxx]@platicly.com> Action: failed Status: 4.0.0
--===143084232====mail.ip.ncnet.ru=== Content-Type: text/rfc822-headers
Received: from [22.214.171.124] (account firstname.lastname@example.org HELO ycwep.com) by mail.ip.ncnet.ru (CommuniGate Pro SMTP 5.2.12) with ESMTPSA id 142886298; Fri, 03 Jun 2016 13:55:17 +0400 From: To: "EHarmonyPartner" <[xxxxxxx]@live-bits.com>, "EHarmonyPartner" <[xxxxxxx]@octport.com>, "EHarmonyPartner"
<[xxxxxxx]@rapidecho.com> Subject: nice story Date: Fri, 3 Jun 2016 12:28:46 +0300 Message-ID: <email@example.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_7EFA7AF8.4214CADC" X-Mailer: Microsoft Outlook 15.0 Thread-Index: AdHD4OenOcoMJM/OvRLBDcH+5LF7TA== Content-Language: en-us