Are you receiving non-delivery notices for messages you never sent? These notices do not mean that spam was actually sent from your account. They are messages that pretended to come from you, using your address as the sender.
In short: these notices come from spam that used your address as the sender, without your account being hacked: delete them and protect your domain with SPF (ending in -all), DKIM and DMARC. If these messages appear in your sent items, change the mailbox password.
Why is your address being used?
Anyone can impersonate you by using your address as the sender, in the same way that anyone can write your address on the back of a postal envelope to make the recipient believe you are the sender.
Spammers (people who send mass advertising messages) use every possible method to bypass anti-spam filters. One of these methods, address spoofing (also called mail forging), consists of modifying the sender address of the messages they send (either by fabricating them or by picking them at random from existing address lists) so as not to arouse the recipients' suspicions. It is then difficult to trace the true source of the message, because the displayed name and address are incorrect. When one of these messages is refused, the non-delivery notice goes back to the displayed address: yours.
These messages are sent in two main ways:
- By a poorly protected mail server that spammers have discovered and use until the problem is noticed and the vulnerability is fixed.
- By Trojan horses that have infected hundreds of thousands of PCs worldwide. These computers ("zombies") automatically send messages without their owners' knowledge, upon request from a spammer (the principle of botnets).
This in no way means that your account has been hacked, that your address has been stolen, or that there has been identity theft. It is rather a technique to bypass anti-spam barriers. Our servers require authentication to send messages, but we cannot prevent a third-party server from writing your address as the sender.
What should I do about these notices?
- Ignore and delete these notices: they require no action on your part.
- Protect your domain: by publishing an SPF record ending in -all, a DKIM signature and a DMARC policy, you allow receiving servers to recognize and refuse messages that spoof your domain. The number of these notices then drops sharply.
- Check what your domain publishes: analyze it with diag.swisscenter.com (the tool is in French). In the Sécurité E-mail (email security) card, the SPF should end with
-all, the DMARC line should show a Politique (policy) p=quarantine or p=reject, and the DKIM line the Détecté (detected) badge. The Constats (findings) card, when it appears, reports what is missing or does not protect, for example a DMARC set to p=none. See Diagnose your domain and email with the SwissCenter diagnostic tool.
- Check your sent items: if the messages in question appear in the sent items folder of your mailbox, this is no longer spoofing. Your mailbox has really been used: change its password right away and follow Unblock a mailbox blocked after sending spam.
Going further