Spoofing??

[Websync]

I just received two emails from spammers using one of my email addresses. (That is addressed both to and from me) Now, I think this is regarded as Spoofing, but not sure. Has never happened before. Can anyone tell me what I can or should do about it?

Thanks in advance

[Matt]

Is your default address enabled?

[Websync]

Hey Matt,
Thanks for the quick reply.

Current Setting: :fail: No Such User Here

[Matt]

I am not really sure at this point, as your default address setting is the way I would recommend doing it. I've seen an increase in spam of the type you describe, I have a ticket in with cPanel now to see if they have any ideas or suggestions on how these are getting through.

[Matt]

Also do you have SPF records setup for your domain?

I would try using this:

"v=spf1 a:server.hostname.com a mx -all"

where "server.hostname.com" is your server's hostname.

This in theory is supposed to reject anything (-all) sent to you using your domain if it does not match the A records of your domain, the MX records of your domain, or the A records of your server hostname. In the current cPanel setup the mailserver sends from the hostname, so the servers hostname should be in your SPF if your domain is on a dedicated IP. If you are on the main server IP you don't really need this section:

a:server.hostname.com

But it seems like it will not hurt and covers you in case you change your domain to use a dedicated IP address. There is some talk that cPanel will add functionality to send from the domain IP itself. if that day comes then the SPF would look like:

"v=spf1 a mx -all"

The above can also be used for hosts that you know will always remain on a shared IP.

[Matt]

Oh and PS. Your WHM > Exim Configuration should have the following checked so that your rules are honored:

Blacklist: SPF Checking [x]

If you have a dedicated server you will have access to your Exim config editor. If you have a shared server, this setting is already enabled.

[Matt]

Additional information on SPF syntax can be found here.

SPF: SPF Record Syntax

Tip:
If you want to ignore SPF checks you can see the "-all" flag to "+all"

[Websync]

I have a ticket in with cPanel now to see if they have any ideas or suggestions on how these are getting through.

Let me know what you find out. This is a new one to me.

[Websync]

Thanks for all the info Matt. No, I don't have any SPF records set up for the domain. The domain is on Ginger. I didn't receive anymore spam mail today, which is nice. Will start a ticket on this if it continues to be a problem.

[Matt]

Well, so long as you remain on the ginger server, then your SPF record would look like this:

"v=spf1 a:ginger.gendns10.com a mx -all"