Have you ever received bounced emails that you never sent? I bet the answer is yes. In case you don’t already know. The most likely reason you are getting these bounced email is because someone hijacked or spoofed your email address. What does it mean?

Image by Michal Zacharzewski

Well, you know how you can enter the “From” email address when you set up your email account? You entered the right address – your own but spammers enter your address. Because the default behavior for emails is to return undelivered to the “from” address, that’s why you are receiving the bounces even though you didn’t send it. It’s a lot like sending someone a letter via snail mail and using someone else’s address instead of your own as the return address.

Isn’t there a way to tell if this is in fact a hijacking and not something you’re doing wrong on your end?

Yes. It involves checking the email headers. Email headers tell a lot. They have information on who – or rather which computer initiated the email. So it is a simple matter to prove you are not the one sending the email. But by then, the damage is often done :-(.

How do you prevent it?

For long time, there was little you could do about it. But now, it is easy to reduce the chances of hijacking if not eliminating them. If your web host supports Sender Policy Framework (SPF), turning it on will be a big step towards blocking people from hijacking your email address.

How does it work?

Quite simple really. It is a checkpoint that will only allow email to be sent from your own domain. When the recipient’s email server receives an email from you and tries to check if the email is legit, it will check the origins of the email. If it came from your domain, the email goes through. If it didn’t, then the server rejects the email. The result, the target of the spammer never receives the spam and your ‘reputation’ is intact.

How do you set it up?

On cPanel hosts it’s pretty easy. Just log in, look for an icon that says Email Authentication. Simply enable or disable SPF. If you are using Gmail or Google Apps to read and receive your emails, then you need to add Google on to the list of allowed domains. Under the spot where it says “Additional Hosts that send mail for your domains (A):”, click Add then enter aspmx.googlemail.com. Save and all is good.

Please be sure to test sending and receiving once you turn it on to ensure your emails are getting delivered to you and from you to the recipient. Last thing we want is to totally disable your emailing ability :-).