Recently we received an odd mail coming from email@example.com to firstname.lastname@example.org
The problem is that address1 didn't send any email to address2. The email was sent using sendgrid. Sendgrid has to be in our SPF due to the use of freshdesk which uses their system.
I was able to recreate the situation with the following: - create a free sendgrid account with a fake email address (email@example.com) - send a transactional email from: firstname.lastname@example.org (email@example.com) to firstname.lastname@example.org. The email goes straight to spam but it stills delivered. However I would like to reject this email.
I have dkim for our principal server, and freshdesk (sendgrid), and SPF for our principal server and once again freshdesk.
I tried with dmarc to reject but the email is still being delivered. At this point I'm out of ideas and I don't know what could be missing.
If the email is sent by freshdesk then it's signed by company.com and if it's spoofed like I mentioned above it will be signed by sendgrid which is generating their own DKIM keys (apparently).
Our server runs in postfix with debian9. Thank you, Diogo Jesus