ML
    • Register
    • Login
    • Search
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups

    Blocking Spoofed Inbound Email - Office365

    IT Discussion
    6
    24
    2367
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DustinB3403
      DustinB3403 last edited by DustinB3403

      OK I found our records,

      We have 4 in place at moment, the top one being what it should.

      The other three are just weird.

      @None 7200 correct spf address from what we can find.
      @None 7200 google-site-verification=9832459823-45=- (some crap)
      @None 3600 928640235(some crap)
      @None 3600 21489789274563(some crap)

      We're checking with the MSP, see if they set these other 3 up for some reason, or if they know what they are.

      JaredBusch 1 Reply Last reply Reply Quote 0
      • JaredBusch
        JaredBusch @DustinB3403 last edited by

        @DustinB3403 said in Blocking Spoofed Inbound Email - Office365:

        OK I found our records,

        We have 4 in place at moment, the top one being what it should.

        The other three are just weird.

        @None 7200 google-site-verification=9832459823-45=- (some crap)
        @None 3600 928640235(some crap)
        @None 3600 21489789274563(some crap)

        We're checking with the MSP, see if they set these other 3 up for some reason, or if they know what they are.

        Those are not for SPF usage. Those are usually added for domain verificaiton purposes for services.

        1 Reply Last reply Reply Quote 0
        • JaredBusch
          JaredBusch @Dashrender last edited by

          @Dashrender said in Blocking Spoofed Inbound Email - Office365:

          @JaredBusch said in Blocking Spoofed Inbound Email - Office365:

          @DustinB3403 said in Blocking Spoofed Inbound Email - Office365:

          .....

          ..........
          ........
          ......
          ....
          ..
          .

          We have no SPF records setup on our domain at all...

          It is technically a TXT record. Make sure you look in the right place.

          It once was TXT, then it was it's own record and now it's back to being a TXT again.

          It was never anything but a TXT record officially. The native SPF record was proposed but never ratified into a standard.

          1 Reply Last reply Reply Quote 0
          • DustinB3403
            DustinB3403 last edited by

            So you think the other 3 records are for something, but lord knows what?

            And the one correct record that we have verified should be doing what it needs?

            JaredBusch 1 Reply Last reply Reply Quote 0
            • JaredBusch
              JaredBusch @DustinB3403 last edited by

              @DustinB3403 said in Blocking Spoofed Inbound Email - Office365:

              So you think the other 3 records are for something, but lord knows what?

              And the one correct record that we have verified should be doing what it needs?

              That first one is obviously for google to verify the site. Likely because your website setup google analytics.

              Others are similar.

              1 Reply Last reply Reply Quote 0
              • Dashrender
                Dashrender last edited by

                Any reason not to post the real DNS record? It's completely public on the interwebs.

                1 Reply Last reply Reply Quote 0
                • DustinB3403
                  DustinB3403 last edited by

                  @Dashrender because I don't actually have them when I said "I" I meant my boss was able to locate them, he paraphrased the records to me.

                  1 Reply Last reply Reply Quote 0
                  • bbigford
                    bbigford last edited by

                    I went way more basic...

                    0_1465855337147_domain.png

                    I found out immediately that a sales site (hosted externally) uses a spoofed email address to work. That stopped working and I just put in an explicit rule for that outside source.

                    JaredBusch 1 Reply Last reply Reply Quote 0
                    • momurda
                      momurda last edited by

                      https://technet.microsoft.com/en-us/library/dn789058(v=exchg.150).aspx

                      If one of those txt records doesnt say
                      v=spf1 include:spf.protection.outlook.com -all
                      It isnt correct for o365.
                      Yours may have some other include:external static ip address of mail server if you have local servers that send email out(spiceworks, backup appliance, etc)

                      1 Reply Last reply Reply Quote 0
                      • JaredBusch
                        JaredBusch @bbigford last edited by JaredBusch

                        @BBigford said in Blocking Spoofed Inbound Email - Office365:

                        I went way more basic...

                        I found out immediately that a sales site (hosted externally) uses a spoofed email address to work. That stopped working and I just put in an explicit rule for that outside source.

                        That will stop internal users form seeing spoofed email, but that has nothing to do with the ability for spoofed email to be sent in your name though.

                        1 Reply Last reply Reply Quote 0
                        • coliver
                          coliver last edited by

                          You could also easily do an nslookup to confirm these records. Just make sure you set the type to txt, on Windows at least.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post