Our company is being impersonated in a mass-email campaign. Several businesses—some existing clients and some we have never worked with—have received messages claiming to be from us and threatening license takedowns unless they remove marketing materials within three days. The messages mention possible action from major advertising platforms, but we have not sent any of them.
We first noticed the issue when one of our inboxes filled with out-of-office replies from unfamiliar companies. We have checked the account and found no suspicious sign-ins or evidence that messages were sent through our systems. Our domain already has DMARC configured, and recent checks passed. The impersonated messages appear to be coming from ordinary external addresses such as Gmail accounts rather than our actual domain.
We are notifying people who contact us that the messages are fraudulent and advising them to mark them as spam. What else should we investigate or configure—such as SPF, DKIM, DMARC enforcement, or subdomain policies? Also, why are we receiving out-of-office replies to messages we did not send, and should we respond to those automatic replies?
3 Answers
Start by obtaining a complete copy of one of the fraudulent messages with its original headers intact. Check the actual envelope sender, Return-Path, From address, Reply-To, sending server, and the SPF, DKIM, and DMARC results. That will tell you whether this is direct spoofing, a lookalike domain, or a compromised account. Confirm that DMARC is enforcing a policy such as p=reject, and consider an appropriate sp=reject policy for subdomains. SPF should also contain every legitimate sender and normally end with -all rather than allowing unknown senders with ~all.
Also check that this is not a lookalike domain or a forged Reply-To address. A domain with a subtle spelling change can pass its own authentication and may look convincing even though it has nothing to do with your organization. Reviewing the full headers and the exact addresses used is more reliable than checking only the display name.
The out-of-office messages are probably legitimate responses from the recipients' mail systems. The attacker sends a message with one of your addresses in the visible sender field, but addresses the message to a real mailbox at another company. That recipient's server sends the automatic reply back to the address shown as the sender, which happens to be yours. The reply does not prove the message originated in your environment; it is simply a backscatter response to a spoofed message.
That explains why the replies are reaching us even though our account shows no outgoing mail. We were mainly unsure whether answering those automatic responses would be useful.
The messages we have seen so far were sent from Gmail addresses, not from our company domain. The team has already cleared the examples, so I will make sure we capture the headers if another one arrives.