I am under heavy attack by the infamous hacker extortion scam. I am hardening the security of my mail server as I run my own Postfix on cloud.
Today I have stumbled upon this evidence in my logs:
dkimproxy.in: DKIM verify - none; message-id=<email@example.com>, from=<firstname.lastname@example.org>
This email claims to come from my own address, as part of the scam's scheme. I am surprised that dkimproxy sets none as verification result for mail coming from my own
example.org, because that domain has a policy. It should have failed miserably
I have just used this tool to confirm that my selector is active. I also used
nslookup type txt to ping for
selector._domainkey.example.org from the Postfix box self and it returned my key.
Question: why is dkimproxy not failing (epically? miserably?) for email that clearly show a forged sender? The email itself does obviously not report any DKIM header. It was my understanding that when a DKIM policy demands mail to be authenticated, mail servers should quarantine/reject those messages according to the policy self.