OK, so last night I started getting a lot of "undelivered" bounce messages on my mail server (postfix+dovecot+mysql).
What confuses me is that they've spoofed my domain, but I have SPF records set up that say only my mail host can send and that receiving servers should be strict about it.
EDIT: my SPF record -
example.org. TXT "v=spf1 a mx ptr -all"
Only consistency through 100+ messages are my domain.
Should I assume that things are OK (on my end) and that these bounces are real bounces, and that the SPF records will flag any mail actually delivered as being spoofed?
Here's complete headers from one message - I've replaced my internal hostname with
srvr1 and my domain with
example.org - all other names/addresses are real. What is bothersome is that it seems the original receiving server isn't flagging this message as spam, even though I have SPF records setup...
Suggestions on this?
Return-Path: <> Delivered-To: email@example.com Received: from mail.example.org by srvr1 (Dovecot) with LMTP id +m3lJVxxkVocZgAAa5pXxw for <firstname.lastname@example.org>; Sat, 24 Feb 2018 14:06:20 +0000 Received: by mail.example.org (Postfix) id 95F85462B3; Sat, 24 Feb 2018 14:06:20 +0000 (UTC) Date: Sat, 24 Feb 2018 14:06:20 +0000 (UTC) From: MAILER-DAEMON@mail.example.org (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: email@example.com Auto-Submitted: auto-replied MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="5CA7D462B1.1519481180/mail.example.org" Content-Transfer-Encoding: 8bit Message-Id: <20180224140620.95F85462B3@mail.example.org> This is a MIME-encapsulated message. --5CA7D462B1.1519481180/mail.example.org Content-Description: Notification Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit This is the mail system at host mail.example.org. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <firstname.lastname@example.org>: host mx1.free.fr[126.96.36.199] said: 550 spam detected (in reply to end of DATA command) --5CA7D462B1.1519481180/mail.example.org Content-Description: Delivery report Content-Type: message/delivery-status Content-Transfer-Encoding: 8bit Reporting-MTA: dns; mail.example.org X-Postfix-Queue-ID: 5CA7D462B1 X-Postfix-Sender: rfc822; email@example.com Arrival-Date: Sat, 24 Feb 2018 14:06:18 +0000 (UTC) Final-Recipient: rfc822; firstname.lastname@example.org Original-Recipient: rfc822;email@example.com Action: failed Status: 5.0.0 Remote-MTA: dns; mx1.free.fr Diagnostic-Code: smtp; 550 spam detected --5CA7D462B1.1519481180/mail.example.org Content-Description: Undelivered Message Content-Type: message/rfc822 Content-Transfer-Encoding: 8bit Return-Path: <firstname.lastname@example.org> Received: from sinovapaint.com (unknown [188.8.131.52]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.example.org (Postfix) with ESMTPSA id 5CA7D462B1 for <email@example.com>; Sat, 24 Feb 2018 14:06:18 +0000 (UTC) Date: Sat, 24 Feb 2018 15:06:16 +0100 To: firstname.lastname@example.org From: "Annabel A." <email@example.com> Reply-To: "Annabel A." <firstname.lastname@example.org> Subject: =?utf-8?Q?Y_a-t-il_d'autres_bons_=C3=A9talons_au_lit_=3F?= Message-ID: <email@example.com> X-Mailer: PHPMailer 5.2.23 (https://github.com/PHPMailer/PHPMailer) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_15f058ce5dc516426d9dc772f549682f" Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED,HTML_MESSAGE, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on srvr1