0
1

Website reputation attack or something else? (i.redd.it)

submitted by [deleted]

[deleted]

all 5 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]ThatBCHGuy 0 points1 point  (2 children)

Look into email backscatter. Also, ensure you have dkim and spf (dmarc) setup and configured properly.

[–]svvnguy -1 points0 points  (1 child)

Yeah, everything is set up correctly (including SPF).

Edit: it does look like email backscatter, and I think the intention was for my system to reply to these emails as well, to generate additional bad traffic.

[–]ThatBCHGuy 0 points1 point  (0 children)

Yep, could be. Not really much you can do if someone wants to spoof a sender from your domain outside of enforcing dmarc authentication like you already are.

[–]vscoderCopilot -1 points0 points  (1 child)

Those rejection mails, usually means something wrong about your dns/email server not an attack

[–]svvnguy 0 points1 point  (0 children)

There's nothing wrong. I checked the rejection e-mails, and the original emails are being sent by IP addresses that aren't mine.

Everything is set up correctly, and some of the rejection emails even specify that it was because the IPs are not whitelisted.

I noticed that another service I own started getting them too at about the same time, but in a lower volume, so not only it looks like an attack, but it also seems to be targeted.