E-Mail from Deleted Internal Address

[Bankesy]

Good morning,

 

Probably not quite the right place for this post but one of our staff recently received an e-mail reporting to be from an internal account\address that was deleted sometime ago and I'm wondering if I've maybe got a bigger security issue here with an external threat actor or spoofing?

 

Thanks

[djm968]

Need a bit more information, can you run a message trace to establish where the email actually originated from?

[KK20]

look in the header, where did it originate? Do you have SPF and DKIM set up? DKIM should stop the spoofing mail being seen as legitimate as the sender.

[Bankesy]

@djm968 @KK20

 

Apologies for the delay in reply, I've got a copy of the message now so I can try and run a trace or look at the header.

 

I don't know if I've got SPF or DKIM setup, we use Office 365 but I guess I would need to check this with LGfL as our DNS and mail filtering is with them.

[Olliedawg]

@djm968 @KK20

 

Apologies for the delay in reply, I've got a copy of the message now so I can try and run a trace or look at the header.

 

I don't know if I've got SPF or DKIM setup, we use Office 365 but I guess I would need to check this with LGfL as our DNS and mail filtering is with them.

 

Put your domain name into here, will tell you if it's setup or not

 

Network Tools: DNS,IP,Email (mxtoolbox.com)

[Bankesy]

@Olliedawg

 

Thanks, looks like SPF was done but not DKIM

[DGardiner]

@Olliedawg

 

Thanks, looks like SPF was done but not DKIM

 

make sure youve not made any whitelists for the internal address/domain

[KK20]

dkim and its corresponding dmarc policy (assuming you reject) will fix the spoofing.

 

https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure

 

make sure the spam intelligence side is also configured

 

https://easydmarc.com/blog/dmarc-and-microsoft/

Edited June 24, 2024 by KK20

[andy_b]

Make sure all these are done:

 

https://www.edugeek.net/forums/general-chat/238015-school-cyber-attacks-up-55-year-year.html#post2037175

[Bankesy]

Maybe I haven't quite got the TXT for DMARC quite right, mine reads:

 

_dmarc..co.uk TXT v=DMARC1; p=quarantine; rua=mailto:[email protected]

 

Which I notice is a bit different to the one in the thread posted by @andy_b and @Michael

[Olliedawg]

Maybe I haven't quite got the TXT for DMARC quite right, mine reads:

 

_dmarc..co.uk TXT v=DMARC1; p=quarantine; rua=mailto:[email protected]

 

Which I notice is a bit different to the one in the thread posted by @andy_b and @Michael

 

What you have there should work - this is mine

 

 

v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=none; fo=1;

[Bankesy]

@Olliedawg

 

Finally got around to changing the DMARC record to exactly what @Michael had put and had a nice notification from NCSC informing me there was no longer an issue so I guess there was something in it, not that NCSC was alerting with the record the way I had it which is interesting.

 

Now for MTA-STS...