DC wants to null route my server IP because of Spoofing

Wabun

• November 14, 2021 06:56

Hi, Sadly one customer stopped using O365 but forgot to modify all DNS records in his domain name and in particular the SPF record. As a result we got warning from spamcop and a threatening email from the DC to nullify our server IP with as net result all other customers will also be effected. Not to talk about the stress and feeling hopeless, will nullify actually stop a spammer who spoofing this domain name in his spam emails in his tracks and why or how does this works? Any help much appreciated.

• 

  cPanelAnthony

  • November 14, 2021 15:30

  Hello! Nullifying the IP would likely stop all email functionality, but I can't be certain. What did your Webhosting provider tell you that "nullifying" the IP would entail? Their definition of nullifying an IP might be different than others. Did they provide you with any other options for email? Also, is this a shared hosting environment? Thanks!

  0
• 

  Wabun

  • November 14, 2021 17:39

  Hiya, well my concern was if the server IP [yes, shared hosting indeed] was nullified, would that really stop spammers making use of the wrongly configured SPF record for that one domain? Would it 100% stop the spamming? Regards your question about options, no they did not provide any other option and from gxxgle around I understand it would mean all websites and email and all other services would be unreachable for outside world, hence I put question here to find out if that null routing would really stop spammers around the globe to misuse it.

  0
• 

  cPanelAnthony

  • November 14, 2021 19:10

  Hello! If the IP was nullified, I believe that would prevent spamming. Without an IP address to route through, the SPF record can't ultimately resolve since the referenced IP address be useable. However, it sounds like there may be a compromised email account or another issue happening here. Would your hosting provider be able to open a ticket with cPanel directly so we can investigate?

  0
• 

  Wabun

  • November 14, 2021 21:24

  Hi, so it would render the spammer spoofing useless? I have the SPF and other records changed asap to reflect the new situation of no longer O365. so the issue is sorted. DC has confirmed the case is closed, but it feels a bit awkward that my business can cut short like that.

  0
• 

  cPanelAnthony

  • November 15, 2021 15:26

  The spammer shouldn't be able to spoof. What did the data center ultimately end up saying about the issue? Just that nulling the IP was the only option?

  0

Please sign in to leave a comment.