Fix Receiving Spoofed Emails from Your Own Domain

If your VPS is receiving fake emails that appear to be sent from your own domain, your DMARC enforcement is likely incomplete. Here’s how to fix it properly.

A client recently reached out with a confusing issue:

“I’m receiving emails from my own address… but I didn’t send them.”

Fiverr Client

At first glance, it looked like the server was compromised. But after checking the headers, it turned out to be something much more common — email spoofing.

This usually happens on self-hosted mail servers (Postfix + Roundcube setups on VPS) where SPF and DMARC are configured, but not enforced locally.

If you’re running your own mail server, this is a very common issue under Email & SMTP Issues.

Problem Summary

Here’s what we observed:

Example from logs:

This clearly indicates spoofing, not a hacked server.

Why This Happens

Email by default does not verify sender identity.

Even if you have:

👉 Your own Postfix server will still accept spoofed emails unless you enforce rules locally.

That’s the gap.

Confirm it's spoofing (not compromise)

Check headers of the email.

Look for:

If the mail originated outside your server → it’s spoofing.

Verify SPF and DMARC records

Make sure your DNS is correct.

Example:

				
					v=spf1 a mx ip4:YOUR_SERVER_IP include:some-domain.com -all

				
					v=DMARC1; p=quarantine; pct=100

This ensures external servers can evaluate your domain.

But this alone does NOT protect your own inbox.

Install OpenDMARC

				
					sudo apt install opendmarc -y

Configure:

				
					Socket local:/var/spool/postfix/opendmarc/opendmarc.sock
AuthservID your.server.hostname
TrustedAuthservIDs your.server.hostname

Chain OpenDKIM + OpenDMARC (critical)

If you already have:

				
					smtpd_milters = inet:localhost:8891

That’s OpenDKIM.

Do NOT replace it.

Instead:

				
					smtpd_milters = inet:localhost:8891, unix:opendmarc/opendmarc.sock
non_smtpd_milters = inet:localhost:8891, unix:opendmarc/opendmarc.sock

Restart Postfix:

				
					systemctl restart postfix

Now your flow becomes:

Don’t reject, send to spam (recommended)

Hard blocking can break legitimate emails (forwarding, mailing lists).

Instead, we tag DMARC failures.

Edit:

				
					nano /etc/spamassassin/local.cf

Add:

				
					header DMARC_FAIL Authentication-Results =~ /dmarc=fail/
describe DMARC_FAIL DMARC authentication failed
score DMARC_FAIL 5.0

Restart:

				
					systemctl restart spamassassin

Now spoofed emails:

Verification

1. Check milter chain

				
					postconf -n | grep milter

You should see both OpenDKIM and OpenDMARC.

2. Send legitimate email

Should pass SPF, DKIM, DMARC

3. Simulate spoof email

Should NOT land in inbox
Should go to spam

Common Mistakes / Edge Cases

Need Help Fixing Your VPS?

If you’re stuck with server issues and need a reliable fix, I troubleshoot real VPS problems daily — from Nginx errors and SMTP failures to DNS and performance issues.

Instead of guessing, get a proven fix based on real experience.

Conclusion

The server wasn’t compromised — it was simply missing local DMARC enforcement.

Once OpenDMARC was properly configured and integrated with Postfix, and SpamAssassin was used to score failures, spoofed emails stopped reaching the inbox.

This is a classic example of why DNS-level protection alone isn’t enough — your mail server must enforce it locally.