Our company is being impersonated in mass emails sent to various businesses, including some of our actual clients. The messages falsely claim that the recipient is violating licensing rules and has three days to remove marketing materials or face takedown notices from major advertising platforms. We have not sent any of these messages.
We discovered the issue after one of our inboxes started receiving large numbers of out-of-office replies from unfamiliar companies. Our account has been checked and shows no unusual sign-in activity. We already use DMARC, and recent checks passed, but the spoofed messages appear to come from ordinary consumer email addresses rather than our domain.
Staff are telling recipients that the messages are fraudulent and advising them to mark them as spam. What should we verify in the email headers and DNS configuration, and is there any appropriate way to handle the automatic replies?
4 Answers
Continue warning recipients, but make the notice short and consistent: explain that the message is fraudulent, provide the official domain and contact method, and tell them not to follow its instructions or links. You can add an anti-impersonation notice to your website or signature, but that will not prevent spoofing by itself. Staff should verify suspicious requests through a known-good contact route rather than trusting the address or signature shown in the message.
The out-of-office replies are expected if the forged message used one of your real addresses as the envelope sender or return address. The recipient's mail system sends the automatic response back to that address, so your server receives it even though your company never sent the original message. Those replies are genuine messages, so blocking all auto-responders would be risky. Usually it is best to leave them alone, perhaps filtering or quarantining the flood temporarily rather than replying to each one.
Get the complete headers from at least one of the fraudulent messages and confirm whether SPF and DKIM passed or failed, which domain was used for DMARC alignment, and which server actually sent the message. Make sure your DMARC policy is enforced with p=reject, and consider sp=reject for subdomains if appropriate. Also review your SPF record and remove anything obsolete; a hard fail with -all may be preferable once you are certain every legitimate sender is included. Check that the messages are not being sent through a compromised internal account or an authorized third-party service.
Passing DMARC tests on your domain does not prove every impersonation attempt will be stopped. The attackers may be using a Gmail address in the visible sender or Reply-To field, a lookalike domain, or a carefully altered address. Inspect the raw headers and compare the From, Return-Path, Reply-To, SPF, DKIM, and DMARC results. Also check whether the domain is misspelled or visually similar to yours. Keep documenting examples and report the abuse through the relevant mail and hosting providers.
We are not planning to block the automatic replies; the main question is whether staff should answer them. Since they are legitimate replies to a forged message, it seems safer to avoid responding unless someone specifically needs confirmation.