Email is getting spoofed with default Cloudflare settings
What are the steps to reproduce the issue?
Hello everyone, first time poster here. I recently set up an email alias to receive emails only, without the ability to send. It worked fine until last week, when I started receiving hundreds of “Mail Delivery Subsystem” notifications with the subject “Delivery Status Notification (Failure).” This suggests my address/domain is being spoofed.
I’m not an expert, but I tried tightening the SPF records to prevent sending emails from my address. I’m unsure if this is enough. Initially, I used the default Cloudflare settings, which I suspect were too lax (~all and +all):
Just like you demonstrated with your SPF above, you do also have multiple conflicting DMARC records:
$ dig +noall +answer TXT _dmarc.francisgrillo.com
_dmarc.francisgrillo.com. 300 IN TXT "v=DMARC1; p=reject; rua=mailto:@me.com"
_dmarc.francisgrillo.com. 300 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
_dmarc.francisgrillo.com. 300 IN TXT "v=DMARC1; p=none; rua=mailto:@me.com"
Note: As first and third seems to be including a personal email address, I removed the local part (the part before @) in the output above, even though DNS records is public data.
DMARC reports sent to a personal email address can cause a lot of email traffic towards you, and they are not that easily readable for all human eyes.
Dropping the first and third DMARC record, and then updating the second one, the one that is sending reports towards Cloudflare, to become “p=reject;” can be advisable.
Highly appreciated, @DarkDeviL. So, I gather that ultimately having one record for each DMARC & SPF is sufficient. I see, I was under the impression that configuring SPF was sufficient to avoid others sending emails on my behalf. Thank you for your help! I’ve updated them.
On that note — even after correcting the SPF and DMARC, I am still getting tons of Delivery Failure emails in my inbox & spam folders. I have the catch-all feature on, i.e. I get emails for all possible addresses. Could this be why?
I am also attaching a screenshot of the DMARC Management page on Cloudflare where it seems that my email is still being used, but bouncing back from servers (assuming that I am interpreting this correctly).
I believe the only remaining problem is that you have your own email address in your DMARC record.
The Sources in your screenshot look like they are supposed to fail, so all is good. You should just let Cloudflare handle the DMARC reporting instead of getting the “spam” to your own address.
