--- title: "Top Three Reasons Spam Looks Like It’s From Your Domain | DuoCircle" description: "We have a few clients complaining about spam that appears to be coming from their own domain." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/announcements/top-three-reasons-spam-looks-like-your-domain-is-spamming/" --- Quick Answer When your customers and staff receive spam that appears to come from your own domain, three causes account for almost all of it. First, missing or weak SPF: attackers spoof your From header because there is no SPF record telling receivers which IPs are authorized to send for your domain. Publish v=spf1 with includes for your real senders (Microsoft 365, Google Workspace, ESPs) and a -all hard fail. Second, no DKIM signing: even with SPF, attackers using forwarded or relayed paths can pass SPF; DKIM cryptographically signs outbound mail with your domain's key so receivers can verify authenticity. Third, no DMARC at enforcement: without DMARC at p=quarantine or p=reject, receivers fall back to lenient defaults and let suspicious mail through. The fix is the SPF/DKIM/DMARC stack at full enforcement, plus aggregate-report monitoring to catch new sending sources. Inbound filtering on its own does not stop your domain from being spoofed at other people's mailboxes. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fannouncements%2Ftop-three-reasons-spam-looks-like-your-domain-is-spamming%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Top%20Three%20Reasons%20Spam%20Looks%20Like%20It%E2%80%99s%20From%20Your%20Domain&url=undefined%2Fblog%2Fannouncements%2Ftop-three-reasons-spam-looks-like-your-domain-is-spamming%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fannouncements%2Ftop-three-reasons-spam-looks-like-your-domain-is-spamming%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fannouncements%2Ftop-three-reasons-spam-looks-like-your-domain-is-spamming%2F&title=Top%20Three%20Reasons%20Spam%20Looks%20Like%20It%E2%80%99s%20From%20Your%20Domain "Share on Reddit") [ ](mailto:?subject=Top%20Three%20Reasons%20Spam%20Looks%20Like%20It%E2%80%99s%20From%20Your%20Domain&body=Check out this article: undefined%2Fblog%2Fannouncements%2Ftop-three-reasons-spam-looks-like-your-domain-is-spamming%2F "Share via Email") ![spam look](https://media.mailhop.org/duocircle/images/2016/07/anti-phishing-software-4911.jpg) We have a few clients complaining about spam that appears to be coming **from their own domain.** We have investigated the issue with multiple customers and we have discovered the three most common reasons why these junk messages that appear to be from their own domain are getting delivered to your mail servers. **There are three common reasons:** 1. \*\*\*\*SPF Records, This is the number 1 reason that bad mail gets through. \*\*\*\*Please ensure that you have an SPF record published for your domain. is a great site to check your current SPF records.Ideally your SPF should contain the IP addresses of your corporate, outbound or other mail servers that you utilize to SEND outbound email. Once you have this information you’ll need to update your SPF records with your DNS provider.Once this is in place your SPF records instructs the DuoCircle Inbound Filter how to handle mail that **appear to come from your domain**, but does not originate from \*\*your servers. Ideally we would drop these messages and mark them as spam. \*\*\*\* **a)** If you use DuoCircle for outbound SMTP our SPF instructions are here. [https://support.duocircle.com/support/solutions/articles/5000519471-how-do-i-use-spf- ](https://support.duocircle.com/support/solutions/articles/5000519471-how-do-i-use-spf-)\*\* **b)** If you use your own servers you’ll have to do some investigations to get SPF working correctly. This can typically be provided by your ISP or your IT Admin. 2. **Whitelists**, You have added your company’s domain name to the WHITELIST in the DuoCircle customer portal. Doing this will skip any inspection rules. And because we have specifically been instructed to whitelist all emails, these nefarious emails will get delivered to your inbox. By default your own domain is not whitelisted.Viruses are being blocked, but the rest will be delivered because of whitelisting. Here is the information on checking your filtering rules, (My advice, unless you need specific rules, it’s best to leave the whitelists alone) 3. \*\*\*\* **Unprotected SMTP Ports / Backup MX -** Some customers still have **mail.domain.com** configured in DNS even though they are using our filtering service.\*\*\*\*Spammers are smart and they are are connecting to mail servers directly, ignoring MX records and bypassing our filtering. In this situation you can either Firewall your server and only accept email from DuoCircle, Change your Delivery Port or update your dns. **a)** You’ll know if this is the reason that the junk is being processed if you look at the headers and there are no references to Mailhop.org in the transaction. **b)** Here is a list of our IP’s for your firewall, [https://support.duocircle.com/support/solutions/articles/5000524218-ip-addresses-for-firewalls ](https://support.duocircle.com/support/solutions/articles/5000524218-ip-addresses-for-firewalls)**c)** The other reason is backup MX services that don’t do spam filtering or antivirus. Your backup MX service is back door to your mail server, make sure that it’s protected and it’s filtering spam. 4. **DMARC** (Commenter Andrew mentioned this)DMARC is a more robust way to authenticate outbound emails and is fully supported by our inbound and outbound mail system. To learn more we have a solutions article that can help. When you are ready to setup DKIM signing, let us know and we can help configure it with you. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ News 3m Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam Jul 20, 2021 ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/)[ News 1m April Spam Filtering Uptime Report May 4, 2016 ](/blog/announcements/april-spam-filtering-uptime-report/)[ News 2m Changes to Spam Filtering Technology Feb 8, 2023 ](/blog/announcements/changes-to-spam-filtering-technology/)[ News 4m Cyber Security News Update, Week 1 of 2020 Jan 3, 2020 ](/blog/announcements/cyber-security-news-update-week-1-of-2020/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Top Three Reasons Spam Looks Like It’s From Your Domain","description":"We have a few clients complaining about spam that appears to be coming from their own domain.","url":"https://www.duocircle.com/blog/announcements/top-three-reasons-spam-looks-like-your-domain-is-spamming/","datePublished":"2016-07-13T01:48:15.000Z","dateModified":"2025-05-09T16:51:25.000Z","dateCreated":"2016-07-13T01:48:15.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/top-three-reasons-spam-looks-like-your-domain-is-spamming/"},"articleSection":"announcements","keywords":"","wordCount":505,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2016/07/anti-phishing-software-4911.jpg","caption":"spam look","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"News"},{"@type":"ListItem","position":3,"name":"Top Three Reasons Spam Looks Like It’s From Your Domain","item":"https://www.duocircle.com/blog/announcements/top-three-reasons-spam-looks-like-your-domain-is-spamming/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"News","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Top Three Reasons Spam Looks Like It’s From Your Domain","item":"https://www.duocircle.com/blog/announcements/top-three-reasons-spam-looks-like-your-domain-is-spamming/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Top Three Reasons Spam Looks Like It’s From Your Domain","description":"We have a few clients complaining about spam that appears to be coming from their own domain.","url":"https://www.duocircle.com/blog/announcements/top-three-reasons-spam-looks-like-your-domain-is-spamming/","datePublished":"2016-07-13T01:48:15.000Z","dateModified":"2025-05-09T16:51:25.000Z","dateCreated":"2016-07-13T01:48:15.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/top-three-reasons-spam-looks-like-your-domain-is-spamming/"},"articleSection":"announcements","keywords":"","wordCount":505,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2016/07/anti-phishing-software-4911.jpg","caption":"spam look","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```