Is my domain spamming?

Question

Fight against spam

There was a very big problem - spam is being sent from my domain. I learn from the responses to letters and Mail Delivery reports coming to the admin mail. The username is different every time - naturally, I don’t have real accounts. As mail, we use Google linked to the domain. Changed the passwords of the hosting admin panel, website, SSH and FTP. For now, it seems to be quiet.
How to determine if it is a backdoor or a fake email headers, and how to get rid of these nasty things.
Thanks in advance for your replies.

Answer 1

Do you have an SPF record?
It's probably smtp-spoofing. SPF will not save 100% from spoofing, but it will make the task of spammers meaningless in most cases and they will fall behind your domain.

Answer 2

The simplest thing is, first of all, to make an SPF for the domain. For google-aps, just add to the entry:
include:aspmx.googlemail.com
Secondly, it would be nice to sign the DKIM domain.
All this if it's just phishing. If you have a beast on the server itself, then carefully look at the logs, run a scanner, such as rkhunter, etc. etc.

Answer 3

I had this problem with Windows Server 2008. Due to my inexperience, I configured the SMTP server poorly, and it allowed the possibility of using it as a mail relay. In my server outbox, about 65k letters were typed and sent without stopping.
Limit the ability of your SMTP mail to be sent from specific IP addresses.
Here test.nettools.ru/ you can check the possibility of using your server as a mail relay.
It was enough for me to leave access to the server only for itself by IP - the mailing lists ended

Answer 4

Can you show examples of emails with headers?

Answer 5

Well. Since the change of all possible passwords, no response from recipients or robots has yet come.