Unsolved Google Apps E-mail Spoofing Question

---

I have a customer who registered his domain name with Google Apps back when it was free. His organization uses the GMail app for e-mail. Recently the customer has had his e-mail address spoofed to e-mail other members in the organization requesting transfer of funds. I have obtained the message headers from these e-mails and am able to prove that the customer's e-mail account was not compromised. Is there any actual steps I can take to eliminate this from happening? I have already reported it to Google and provided them with the complete message headers.

Thanks,

James

@James-Creen,

I'll direct you to Google's Postini Services support page here: https://www.google.com/support/enterprise/static/postini/docs/admin/en/admin_ee_cu/secur_rpf.html

I haven't dealt with gmail spoofing specifically but other members may have and will hopefully chime in and give some more detailed response than I have.

Thanks Ronnie, I appreciate it!

@James-Creen I wanted to follow up on this real quick. E-mail address spoofing is a pretty common occurance. The main reason is that authentication is not included in the SMTP standard for transmitting e-mails between servers. Unfortunately, that means any user can spoof the e-mail address of any other user if they desire. For example, if you use Microsoft's SMTP test process you can insert whatever address you want in the MAIL FROM step.

There is no way to prevent other users from doing this. The closest thing you have is creating an SPF record in DNS that defines which e-mail servers are allowed to relay e-mail for your domain. You can see if you already have an SPF record over at MX Toolbox. Google has posted instructions on how to create an SPF record to support Google Apps. Once the record is in place, any receiving server can do an SPF lookup to verify the e-mail is coming from a legitimate source. It isn't perfect, but it is the best we have for now.

The super-secure method to solve the problem is to PGP sign all of your e-mails and tell recipients to reject any un-signed message from your account. Getting end-user buy-in for that is next to impossible, though, so the SPF record is the only practical option for now.

Hope that helps,

Don Pezet
Host, ITProTV