Spam is being sent using my domain, what can I do?
dns, email, google-apps, spam
Solution
I've noticed an increase in this kind of spoofing in the last few weeks as well.
The Google support page on this issue notes:
"Because these messages originate outside of Gmail, we aren't able to stop spammers from spoofing your address. However, Google helps protect your Gmail address's reputation by designing our systems to authenticate all the mail that really comes from you. When another domain receives an unauthenticated message from Gmail, it can tell that you didn't really send the mail, and it is unlikely that your email address will be blocked. For our part, we are concerned about spoofing and bouncebacks. We ask you to report these messages by checking the box next to the unwanted message and clicking Report Spam at the top of your inbox, or by opening the message and clicking Report Spam at the top of the message."
"You can help stop spammers by also sending the full headers of these unlawful messages to the Federal Trade Commission at spam@uce.gov."
Problem
Since it was released I've been using Google Apps FYD for `stackednotion.com`. All of the email I send goes through Google's servers and I use Gmail to view my email. I haven't had any issues before, however recently I've been seeing weird bouncebacks ending up in the catch all account. It looks like somebody is using my domain to send spam. I don't really want my domain getting marked with a bad reputation, so how can I stop this? I have setup SPF, DMARC and DKIM on the domain by following the guides on Google Apps, here is my zone file: ``` ; stackednotion.com [9548] $TTL 86400 @ IN SOA ns1.linode.com. luca.stackednotion.com. 2012072633 7200 7200 1209600 86400 @ NS ns1.linode.com. @ NS ns2.linode.com. @ NS ns3.linode.com. @ NS ns4.linode.com. @ NS ns5.linode.com. @ MX 1 ASPMX.L.GOOGLE.COM. @ MX 5 ALT1.ASPMX.L.GOOGLE.COM. @ MX 5 ALT2.ASPMX.L.GOOGLE.COM. @ MX 10 ASPMX2.GOOGLEMAIL.COM. @ MX 10 ASPMX3.GOOGLEMAIL.COM. @ MX 30 ASPMX4.GOOGLEMAIL.COM. @ MX 30 ASPMX5.GOOGLEMAIL.COM. @ TXT "v=spf1 include:_spf.google.com ~all" google._domainkey TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDi19ipSdqDEpnJEWrVF7MarSLnlzXi0wPOHws2BY6oMQInbY5OHzdw9LcFr1biVvipErm4odyJfjZAIp5s8r6z50ZxQdW5Uwdy9krA1A9HMPaqVN+fm2xpntU//uXn0wD8sGc9CljYQIl+MusxQ690PfVGnAz/QeLqaZFxpHHmmQIDAQAB" _dmarc TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@stackednotion.com" @ A 178.79.164.64 * A 178.79.164.64 _xmpp-server._tcp SRV 5 0 5269 xmpp-server.l.google.com. _xmpp-server._tcp SRV 20 0 5269 alt1.xmpp-server.l.google.com. ``` Also here are the headers of a spam message (somebody tried to susbscribe me to a Zend mailing list, what kind of sick people are they?!?): ``` Return-Path: <F776387@stackednotion.com> Received: (qmail 20117 invoked from network); 27 Jul 2012 06:51:01 -0000 Received: from exprod7mx200.postini.com (HELO psmtp.com) (64.18.2.92) by rsmx2.zend.com with SMTP; 27 Jul 2012 06:51:01 -0000 Received: from source ([188.51.41.223]) by exprod7mx200.postini.com ([64.18.6.13]) with SMTP; Fri, 27 Jul 2012 02:51:00 EDT To: <fw-docs-subscribe@lists.zend.com> Subject: Invoice #48469883494 From: "Order" <F776387@stackednotion.com> Date: Sat, 28 Jul 2012 09:40:03 +0300 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: IPS PHP Mailer MIME-Version: 1.0 Content-type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit Message-ID: <20120728094003.9312B884F9D66F02CE7C@DELL-PC> X-pstn-neptune: 500/484/0.97/100 X-pstn-levels: (S: 0.00346/89.11253 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 ) X-pstn-dkim: 0 skipp ```