-1

I received an email from a supplier that was hacked.

Customer domain is (header.from = dhavalgroup.com), but the email was sent from (smtp.mailfrom = deltaexports.us).

How to protect this kind of fake email?

Authentication-Results: spf = none (IP sender is 173,201,192,164)
smtp.mailfrom = deltaexports.us; mydomain.com.br; dkim = none (message not
signed) header.d = none; mydomain.com.br; DMARC = none action = none
header.from = dhavalgroup.com; mydomain.com.br; dkim = none (message not
signed) header.d = none;
Received-SPF: None (protection.outlook.com: deltaexports.us does not designate
permitted sender hosts)
Received: from p3plwbeout13-02.prod.phx3.secureserver.net (173,201,192,164) by
BN1BFFO11FD048.mail.protection.outlook.com (10.58.145.3) with Microsoft SMTP
Server (version = TLS1_2, cipher = TLS_RSA_WITH_AES_256_CBC_SHA) id 15.1.669.7
Frontend via Transport; Mon, 17 Oct 2016 08:56:30 +0000
Received: from localhost ([173,201,192,136])
              by p3plwbeout13-02.prod.phx3.secureserver.net with bizsmtp
              id wYwV1t0012x1vXx01YwVbq; Mon, 17 Oct 2016 01:56:29 -0700

Thank you.

Improve this question
3
  • 3
    As the headers hint, SPF and DKIM records would likely help.
    – ceejayoz
    Oct 21, 2016 at 2:03
  • Is this the full Received: from chain ? Because looks like it's not.
    – drookie
    Oct 21, 2016 at 14:25
  • I've never seen even Exchange used commad-quad notation for IPv4 addresses.
    – user
    Nov 7, 2016 at 9:08

1 Answer 1

Reset to default
2

To optimize the protection you need SPF, DKIM and DMARC. Your domain is hosted by outlook.com. A spf record is configured.

How-To to enable DKIM for your Domain. http://o365info.com/how-to-enable-outbound-dkim-signing-for-your-domain-in-office-365-part-5-of-5/

Information about DMARC https://blogs.msdn.microsoft.com/tzink/2014/12/03/using-dmarc-in-office-365/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .