0

Today received a mail who appears to be coming from a account from our domain, but when mail header is analized it comes from another server and user.

Mail arrived from a real owned domain directed to a real account on my owned domain.

How is this possible?

How i can avoid this problem?

Mail Header edited partially for security reasons:

Received: from SN6PR06MB4765.namprd06.prod.outlook.com (2603:10b6:805:ca::39)
 by SN6PR06MB4765.namprd06.prod.outlook.com with HTTPS via
 SN6PR16CA0062.NAMPRD16.PROD.OUTLOOK.COM; Thu, 24 Jan 2019 17:27:23 +0000
Received: from DM6PR06CA0047.namprd06.prod.outlook.com (2603:10b6:5:54::24) by
 SN6PR06MB4765.namprd06.prod.outlook.com (2603:10b6:805:9e::23) with Microsoft
 SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.1558.17; Thu, 24 Jan 2019 17:27:21 +0000
Received: from BL2NAM02FT029.eop-nam02.prod.protection.outlook.com
 (2a01:111:f400:7e46::204) by DM6PR06CA0047.outlook.office365.com
 (2603:10b6:5:54::24) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1558.16 via Frontend
 Transport; Thu, 24 Jan 2019 17:27:20 +0000
Authentication-Results: spf=pass (sender IP is 66.96.184.5)
 smtp.mailfrom=eigbox.net; **myrealdomain.com**; dkim=none (message not signed)
 header.d=none;**myrealdomain.com**; dmarc=fail action=oreject
 header.from=**myrealdomain.com**;compauth=fail reason=000
Received-SPF: Pass (protection.outlook.com: domain of eigbox.net designates
 66.96.184.5 as permitted sender) receiver=protection.outlook.com;
 client-ip=66.96.184.5; helo=bosmailout05.eigbox.net;
Received: from bosmailout05.eigbox.net (66.96.184.5) by
 BL2NAM02FT029.mail.protection.outlook.com (10.152.77.100) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.1558.11 via Frontend Transport; Thu, 24 Jan 2019 17:27:20 +0000
Received: from bosmailscan09.eigbox.net ([10.20.15.9])
    by bosmailout05.eigbox.net with esmtp (Exim)
    id 1gmime-0001Df-40
    for **[email protected]**; Thu, 24 Jan 2019 12:27:20 -0500
Received: from [10.115.3.33] (helo=bosimpout13)
    by bosmailscan09.eigbox.net with esmtp (Exim)
    id 1gmime-00083z-09
    for *[email protected]**; Thu, 24 Jan 2019 12:27:20 -0500
Received: from bosauthsmtp06.yourhostingaccount.com ([10.20.18.6])
    by bosimpout13 with 
    id UHSH1z00E07rX7u01HSLMQ; Thu, 24 Jan 2019 12:26:20 -0500
X-EN-SP-DIR: OUT
X-EN-SP-SQ: 1
Received: from [190.146.197.219] (port=9098 helo=10.1.29.91)
    by bosauthsmtp06.eigbox.net with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
    (Exim)
    id 1gmilb-0004Nx-Pw
    for *[email protected]**; Thu, 24 Jan 2019 12:26:17 -0500
Date: Thu, 24 Jan 2019 12:26:21 -0500
**From: Presidencia <[email protected]>**

Thanks in advance.

1 Answer 1

1

Faking the From: header is easy.

Only dkim(+dmarc) on your domain will help, and then only for receivers who actually check dkim and dmarc.

DKIM will include a digital signature based on several headers, including the From:. Receivers can check the public key in the DNS of your domain and verify the signature.

DMARC will stipulate policy about what to do when DKIM (and SPF) break.

8
  • It seems that SPF passed: Received-SPF: Pass (protection.outlook.com: domain of eigbox.net designates 66.96.184.5 as permitted sender) receiver=protection.outlook.com; client-ip=66.96.184.5; helo=bosmailout05.eigbox.net; DMARC failed: header.d=none;**myrealdomain.com**; dmarc=fail action=oreject And my server is configured for rejection... Why passed verifications ? Jan 24, 2019 at 19:56
  • Because sender is eigbox.net, and eigbox.net allows the sender.
    – RalfFriedl
    Jan 25, 2019 at 6:40
  • What is your Exchange environment, Exchange hybrid or on-premise with EOP? How do you configure your DMARC record?
    – Shaw Lu
    Jan 25, 2019 at 8:46
  • @user3555185 SPF only protects against the SMTP MAIL FROM, not the From: header.
    – Halfgaar
    Jan 25, 2019 at 9:30
  • RalfFriedl So, .eigbox.net may be or is actually a source of spam, without knowing? Jan 25, 2019 at 13:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .