This guide details the mechanisms of email spoofing and the protection measures against unwanted messages that appear to come from your own domain.

Has my account been used without my knowledge?

Receiving an email that appears to be sent by you is a common psychological manipulation technique. This does not necessarily mean that your email account has been compromised. In most cases, it is simply a forged "From" header, similar to someone writing your address on the back of a paper envelope before mailing it.

Make sure that your own address is not listed in the allowlist of your anti-spam filterIf it is found, the security system ignores the security scan, assuming that the message is legitimate.

Diagnosis: Spoofing vs. Hacking

It is crucial to distinguish spoofing from intrusion. The global email sending protocol (SMTP) was designed without native sender identity verification.

Strengthen your domain's integrity

To protect your digital reputation and limit the impact of these impersonations, implementing authentication protocols is the professional standard:

• SPF & DKIM: These digital signatures certify that your messages originate from our authorized servers.
• DMARC: This essential protocol allows you to give instructions to servers worldwide (e.g., "If the email is not signed by Infomaniak, reject it or place it in spam"). This is the most powerful tool foranalyze and limit fraudulent use of your domain.
• Catch-all management: Avoid using a "catch-all" address, which collects all messages sent to non-existent addresses on your domain, as it naturally attracts large volumes of spam.

Failure Notifications (Backscatter)

If you receive non-delivery reports for messages you never wrote, you are experiencing the phenomenon of Backscatter. Third-party servers that are poorly configured or botnets are using your identity to send mass content. When they encounter a non-existent address, the remote server sends the error to the displayed sender: you.