hello all, (just new to network admin few months in the job)
so to give a bit of background on our system we have a exchange 2013 server with a external and internal domains, for instance our internal domain is abcinternal.co.uk used for our systems and users ect and our external domain is abcexternal.com our mail server is mail.abcexternal.com used for emails on ip xxx.xxx.183.114
Internal Domain - abcinternal.co.uk
External Domain - abcexternal.com
issue we have been having recently is we have been getting domain spoofed i have setup a SPF record on our external DNS for abcexternal.com which reads "v=spf1 mx mx:mail.abcexternal.com ip4:xxx.xxx.183.114 -all" but we keep getting spoofed emails even with this, firstly does the SPF record look correct and secondly would i need to create a SPF record for the internal domain on the external DNS too, to give you a example, this is the header from a email that was send recently (spoofed)
any suggestions what i can do to fix this, i know the SCL is high but out SCL filter is very low due to email junk issues
Received: from IEXCHANGE2013.abcinternal.co.uk (xxx.xxx.254.201) by
IEXCHANGE2013.abcinternal.co.uk (xxx.xxx.254.201) with Microsoft SMTP
Server (TLS) id 15.0.712.24 via Mailbox Transport; Wed, 18 Dec 2013 13:32:07
+0000
Received: from IEXCHANGE2013.abcinternal.co.uk (xxx.xxx.254.201) by
iexchange2013.abcinternal.co.uk (xxx.xxx.254.201) with Microsoft SMTP
Server (TLS) id 15.0.712.24; Wed, 18 Dec 2013 13:32:06 +0000
Received: from 061244048185.static.ctinets.com (61.244.48.185) by
IEXCHANGE2013.abcinternal.co.uk (xxx.xxx.254.201) with Microsoft SMTP
Server id 15.0.712.24 via Frontend Transport; Wed, 18 Dec 2013 13:32:05 +0000
Received: from [204.122.243.204] (port=90614 helo=[xxx.168.9.06]) by
61.244.48.185 with asmtp id 1rqLaL-000MX-00 for user@abcexternal.com;
Wed, 18 Dec 2013 21:34:53 +0800
Message-ID: <52B1A3A5.4000703@abcexternal.com>
Date: Wed, 18 Dec 2013 21:34:53 +0800
From: Voice Mail <user@abcexternal.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20110929 Thunderbird/7.0.1
MIME-Version: 1.0
To: <user@abcexternal.com>
Subject: [virus Win32/TrojanDownloader.Waski.A trojan] New Voice message
Content-Type: multipart/mixed;
boundary="----=_Part_51648_8160897801.7764692916738"
X-Spam: Not detected
X-Mras: Ok
Return-Path: AmericanExpress@welcome.aexp.com
X-MS-Exchange-Organization-Network-Message-Id: 86a83526-e1f9-4a37-381e-08d0ca0cade7
X-ESET-AS: SCORE=80
X-MS-Exchange-Organization-SCL: 8
X-EsetResult: clean (cleaned), contained Win32/TrojanDownloader.Waski.A trojan
X-EsetId: F1A06A3BE6A78839EBE83527B4B88E39B3E56463EC
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
X-MS-Exchange-Organization-AuthSource: iexchange2013.abcinternal.co.uk
X-MS-Exchange-Organization-AuthAs: Anonymous
best regards
Gordon