sp*m sender and spf issue

webstyler

Well-Known Member
Nov 20, 2003
467
2
168
Hello

one customer receive email from "false sender", where From indicate email and domain but is envelope from other (not auth)

For domain (in the From) there is a valid spf, all check is fine.

In the email header received we see:

-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

record spf is:

v=spf1 +a +mx +ip4:x.x.x.x ~all

Any suggest?

Thanks
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
10,360
1,632
363
cPanel Access Level
Root Administrator
Hey there! It sounds like this message was a spoof, which is where the "from" address is forged to look like it was coming from somewhere else. More details on that can be found here:


Can you check out that article to see if that was indeed what was happening on your system?