Hi, I have noticed from dmarc report that unknown ip is sending mails using my hosting domain.
Refer below record:
record
row
source_ip>119.252.155.65</source_ip
count>1</count
policy_evaluated
disposition>none</disposition
dkim>pass</dkim
spf>fail</spf
/policy_evaluated
/row
identifiers
header_from>xxxx.com</header_from
/identifiers
auth_results
dkim
domain>xxxx.com</domain
result>pass</result
selector>mail</selector
/dkim
spf
domain>fareast.co.in</domain
result>pass</result
/spf
/auth_results
/record
I’m not using this source ip or not given permission to send mails.(Not included in mx record)
But it seems they have able to send mail using my xxxx.com domain. It seems some how they had my private key. So i need to regenerate dkim keys for that specific domain.
could some one help me to regenerate dkim keys for that domain.
(please note this is not a failure of Mail-in-a-Box server. It seems i have allowed access to my third party team for DNS zone sometime back and from that it seems to be got exposed)
Any help in this regards is highly appreciated.