Why am I receiving from "[email protected] "

[Networkologist]

One of my domains which is using Clouflares free version, every once in a while, instead of the report coming from "[email protected]" I receive:
"[email protected]" I've xxxxxx out my domain name from the xml file:


<?xml version='1.0' encoding='utf-8'?>
<feedback><report_metadata><org_name>Mail.Ru</org_name><email>[email protected]</email><extra_contact_info>Почта</extra_contact_info><report_id>13626050050518643271623974400</report_id><date_range><begin>1623974400</begin><end>1624060800</end></date_range></report_metadata><policy_published><domain>xxxxxx.com</domain><adkim>r</adkim><aspf>r</aspf><p>reject</p><sp>reject</sp><pct>100</pct></policy_published><record><row><source_ip>178.165.91.59</source_ip><count>1</count><policy_evaluated><disposition>reject</disposition><dkim>fail</dkim><spf>fail</spf></policy_evaluated></row><identifiers><header_from>xxxxxxx.com</header_from></identifiers><auth_results><spf><domain>xxxxxx.com</domain><scope>mfrom</scope><result>softfail</result></spf></auth_results></record><record><row><source_ip>196.216.71.74</source_ip><count>1</count><policy_evaluated><disposition>reject</disposition><dkim>fail</dkim><spf>fail</spf></policy_evaluated></row><identifiers><header_from>xxxxxx.com</header_from></identifiers><auth_results><spf><domain>nxxxxxxx.com</domain><scope>mfrom</scope><result>softfail</result></spf></auth_results></record></feedback>

 

[cPRex]

Hey there! The short answer is that someone is likely trying to spoof email from your domain and this is the notification. There are some additional details on this here:

DMARC report for mails I didn't send

I set up DKIM, DMARC and SPF on my domain/server a few years ago, and never touched it again since then. Here are my DNS records (my domain is mydomain.com and my IP addresses are 1.1.1.1 and 2001...

security.stackexchange.com

 

[Networkologist]

Thanks for the reply.

My dmarc is set to reject.

At least they're being rejected. No further reports from mail.ru but I'll keep an eye on it.