How should we respond to emails impersonating our company?
Asked by
MellowCedar47
Our company is being impersonated in a mass-email campaign. Several businesses—some existing clients and some we have never worked with—have received messages claiming to be from us and threatening license takedowns unless they remove marketing materials within three days. The messages mention possible action from major advertising platforms, but we have not sent any of them.
We first noticed the issue when one of our inboxes filled with out-of-office replies from unfamiliar companies. We have checked the account and found no suspicious sign-ins or evidence that messages were sent through our systems. Our domain already has DMARC configured, and recent checks passed. The impersonated messages appear to be coming from ordinary external addresses such as Gmail accounts rather than our actual domain.
We are notifying people who contact us that the messages are fraudulent and advising them to mark them as spam. What else should we investigate or configure—such as SPF, DKIM, DMARC enforcement, or subdomain policies? Also, why are we receiving out-of-office replies to messages we did not send, and should we respond to those automatic replies?
Answers
The out-of-office messages are probably legitimate responses from the recipients' mail systems. The attacker sends a message with one of your addresses in the visible sender field, but addresses the message to a real mailbox at another company. That recipient's server sends the automatic reply back to the address shown as the sender, which happens to be yours. The reply does not prove the message originated in your environment; it is simply a backscatter response to a spoofed message.
Reply to this answer
Also check that this is not a lookalike domain or a forged Reply-To address. A domain with a subtle spelling change can pass its own authentication and may look convincing even though it has nothing to do with your organization. Reviewing the full headers and the exact addresses used is more reliable than checking only the display name.
Reply to this answer
Start by obtaining a complete copy of one of the fraudulent messages with its original headers intact. Check the actual envelope sender, Return-Path, From address, Reply-To, sending server, and the SPF, DKIM, and DMARC results. That will tell you whether this is direct spoofing, a lookalike domain, or a compromised account. Confirm that DMARC is enforcing a policy such as p=reject, and consider an appropriate sp=reject policy for subdomains. SPF should also contain every legitimate sender and normally end with -all rather than allowing unknown senders with ~all.
LimeOrbit22: The messages we have seen so far were sent from Gmail addresses, not from our company domain. The team has already cleared the examples, so I will make sure we capture the headers if another one arrives.
Reply to this answer
I would not reply to the automatic out-of-office messages. They are genuine inbound messages, so blocking them broadly could hide useful mail, but there is usually nothing actionable in an automated response. Keep monitoring them for patterns, use normal mail filtering if the volume becomes disruptive, and retain a few samples for investigation. Continue giving real recipients a short confirmation through a trusted contact method, and consider publishing a notice on your website or in standard signatures explaining how genuine company emails can be verified.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar47: That explains why the replies are reaching us even though our account shows no outgoing mail. We were mainly unsure whether answering those automatic responses would be useful.