Removal of Permitted Designated Sender from Email(hacked)

[javadudd]

I appear to have had my email hacked and friends were report an email from myself i.e. proper email address etc. I actually received the same email to another email address.

I checked the original header and there is a suspicious entry in here

spf=pass (google.com: domain of <myemail>@blueyonder.co.uk designates 212.54.57.96 as permitted sender)

Is there a way to fix this?

I've changed account password etc and they obviously have managed to send out emails to a list of contacts

[Sololobo]

For Information.

The IP address noted resolves to smtpq1.tb.ukmail.iss.as9143.net, an email server run by Ziggo from the Netherlands, a company used by Virgin media for the provision of their email services.

[javadudd]

Ahh ok it must be ok then.

Just don't see how they have sent out emails to my contacts looks like me and the header has my return address but emails look like they are being diverted.

Or people are saying they have replied but I haven't seen any emails come through from them.

[ravenstar68]

Just to clarify this

I checked the original header and there is a suspicious entry in here

spf=pass (google.com: domain of <myemail>@blueyonder.co.uk designates 212.54.57.96 as permitted sender)

This is an authentication check on the Envelope Sender: (Which can be found in the header as Return-Path:)  It checks that the IP address is allowed to send mails for the domain.

Breaking it down:

SPF (Name of check) - Sender Policy Framework
google.com - Receiving Domain
myemail@blueyonder.co.uk - Envelope Sender
22.54.57.96 - IP address that connected to google.com's inbound server

In normal cases the IP address will belong to the mail servers used by the domain in red.  (Although there are circumstances where legitimate mail will fail SPF - Which is why VM sign their mails using DKIM as well).

SPF pass means that mails we're sent from an IP address authorised by Virgin Media
DKIM pass means that the mail is signed by a key belonging to the domain owner.

DMARC is used to evaluate the resuts - So long as EITHER SPF or DKIM pass then DMARC will pass.

Look for an X-Authorized: Header in the mail.

Is it blank or does it have your email address.

Also look at the Received lines starting at the bottom most and working up.  You should see the point at which it's delivered TO Virgin Media;s mail server.  Check the public IP address that makes the connection.

Tim