Hello Mfoley,
I'm no expert at all but the following is what I do:
1. I use a combination of
OpenDKIM (Installed and configured locally) /
SPF (configured via your DNS records) /
DMARC (again configured via your DNS records) - utilising all 3 will reduce the chances of your domain being spoofed.
2. Ensure your mail server is not currently set as an Open Relay - there are a large no.of tools you can use to test this such as:
https://mxtoolbox.com/diagnostic.aspx - SMTP diagnostics test.
3. Use a DMARC report analyser such as:
https://eu.dmarcadvisor.com/dmarc-xml/ OR
https://us.dmarcian.com/dmarc-xml/ just to confirm there are no issues - they allow you to upload your XML files.
The following is essentially what I use (via a quick Google) and includes remediation steps - i'm guessing as you have Senior status on here this may be something you already have in place:
- Enable DMARC ReportingFirst, ensure you have an active DMARC record published in your DNS that includes a reporting email address. Your DMARC TXT record should look something like this:v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=1002.
- Identify Spoofing IndicatorsOnce you start receiving XML reports (or using a DMARC visualization tool), look for these key data points:Unrecognized IP Addresses: Check the
<source_ip> field in the report. If an unfamiliar IP address is sending emails that claim to come from your domain, it is likely a spoofing attempt.
- Failed SPF (spf) or DKIM (dkim) Status: Check the
<auth_results> section. If the sending IP does not match your authorized SPF records, or if the digital signature (DKIM) fails or is missing, the authentication check will fail.
As in my case I get an SPF fail because I am using a standard household dynamic IP Address and not a static business one therefore my SPF resolves to my ISP
- DMARC Failure: If both SPF and DKIM fail (or lack "alignment" with your domain), the dmarc_result will show as fail.
- Take ActionAnalyze Legitimate Senders First: Ensure that failing emails are not actually coming from a legitimate third-party service (e.g., Mailchimp, Salesforce) that you forgot to authorize in your SPF or DKIM setup.Upgrade Your Policy: If the failing IPs are definitively not yours, you are being spoofed. Once all legitimate sending sources are verified and authenticated, update your DMARC policy from p=none (monitoring only) to p=quarantine or p=reject to block spoofed emails from reaching inboxes.
- Useful Tools to Read ReportsRaw DMARC XML reports are dense and difficult to read manually. You can use DMARC parsing and visualization services to easily spot spoofers and unauthorized IPs:MXToolboxPostmark DMARCDMARC Analyzer
One thing I noticed is that you have 2
<source_ip> entries - 1 of them should be your WAN address but what does the other IP correspond to?
A lookup on the domain
hojgdt.cnm reveals the following per:
https://whois.domaintools.com/hojgdt.cn - there's a few potential red flas there:
- View the information concverning the IP / Hosting History
- The registrant contact email address looks suspect.
Via a couple of scanners:
https://www.bitdefender.com/en-us/co...cker/malicious - if you enter the domain
hojgdt.cn it provides a warning
https://www.brightcloud.com/tools/url-ip-lookup.php
Whilst
https://www.virustotal.com/gui/url/8...e06e4236222b74 - Fortinet flags it as a potential spammer
https://www.abuseipdb.com/check/118.103.125.98 - report it as an SMTP scanner attempting to use customer mailservers as relays.
Hope the above helps somewhat.
Regards,
Rawcous
