sp*m sender and spf issue

[webstyler]

Hello

one customer receive email from "false sender", where From indicate email and domain but is envelope from other (not auth)

For domain (in the From) there is a valid spf, all check is fine.

In the email header received we see:

-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

record spf is:

v=spf1 +a +mx +ip4:x.x.x.x ~all

Any suggest?

Thanks

 

[cPRex]

Hey there! It sounds like this message was a spoof, which is where the "from" address is forged to look like it was coming from somewhere else. More details on that can be found here:

Preventing spoofed emails

Symptoms If you've had an email delivered that was sent from your address, and you know you didn't send the message, that's an example of a spoofed email. These are often used in phishing scams or...

support.cpanel.net

Can you check out that article to see if that was indeed what was happening on your system?