3 ms·
This is commonly known as a Joe Job - https://en.wikipedia.org/wiki/Joe_job https://en.wikipedia.org/wiki/Joe_job Steps to mitigate. 1. Setup SPF immediately.
by bks 11y ago
This is commonly known as a Joe Job - https://en.wikipedia.org/wiki/Joe_job https://en.wikipedia.org/wiki/Joe_job
Steps to mitigate.
1. Setup SPF immediately. You can validate your records here- http://www.kitterman.com/spf/validate.html http://www.kitterman.com/spf/validate.html
You'll have to know who you send email through and their SPF record, but a quick googling of "provider name SPF" should get you what you need.
Depending on your DNS provider the results may be instant.
2. Filter those bounces keep them out of your inbox - it's going to take while until this clears up.
3. Make sure that YOU are not hacked, check the headers of the bounce back messages here - http://mxtoolbox.com/EmailHeaders.aspx http://mxtoolbox.com/EmailHeaders.aspx
Ensure that your IP or hostname is not listed there. (This includes web servers that your domain is hosted on, apps that send on your behalf etc)
4. You can check to see if your domain is black listed - http://mxtoolbox.com/blacklists.aspx http://mxtoolbox.com/blacklists.aspx probably not...but worth a check.
TL;DR - I run one of the largest spam filtering companies in the world. Happens all day to clients...it's one of the reasons people switch to us.
- linkregister 11y agoUPDATE: The OP is using GMail. This doesn't apply to her/him but it's still good advice so I'm keeping it up. I think it's also worthwhile to mention DMARC: https://dmarc.org/overview/ https://dmarc.org/overview/. Most of the major Email Service Providors (ESPs) support it. SPF and DKIM signatures are two data points to help form an opinion about whether a message is legitimate. DMARC is your published policy about what to do with email that fails SPF and DKIM. If you have the strictest DMARC policy along with good SPF and DKIM records, and you're signing all your outgoing email correctly with DKIM, then this should solve your problem. It's recommended to start with the most permissive DMARC settings (p=none) so you can make sure you don't prematurely block your own outgoing email. I work for one of the larger (by market share) "send email via an API" services. This is a common issue we come across with our customers.
- jsvaughan 11y ago+1 for DMARC - you can set your policy to ask the recipient to reject (or mark as spam) anything that fails the DMARC check. But yes, it is tricky to get right, so go for no action initially and monitor the reports.
- Mafana0 11y agoThanks for the informative post. I know you didn't make it to advertise, but do you mind sharing your product name/info? It might be interesting to people following the discussion who have a similar situation or concern.
- bks 11y agoduocircle.com
- exhilaration 11y agoThose tools are very nice, thanks for putting them together.