Why Are My Emails Going To Spam After A Ransomware Attack?

Summary

This guide helps you troubleshoot and resolve: Why Are My Emails Going To Spam After A Ransomware Attack?. Follow the steps below to fix the issue.

Common Causes

Following a ransomware attack, it is common for legitimate business emails to suddenly start landing in recipients' spam folders or being rejected entirely. This usually happens because attackers may have altered your domain's DNS authentication records, or because your domain's reputation has been damaged by spam sent during the compromise. Major email providers like Google and Microsoft rely on authentication protocols such as SPF, DKIM, and DMARC to verify that an email actually comes from your organisation. When these records are missing or incorrect, your messages are treated as suspicious.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Quick Fix Steps

1. Verify your domain's SPF record is correct and includes your current email provider.
2. Ensure DKIM is enabled and the public key is published in your DNS.
3. Review your DMARC policy to ensure it is not set to reject while authentication is failing.
4. Check if your domain or mail server IP is listed on any email blacklists.
5. Ask recipients to mark your emails as "Not Spam" to help rebuild sender reputation.

Detailed Instructions

1. Audit your DNS authentication records

1. Log in to your domain registrar or DNS hosting control panel.
2. Navigate to the DNS management or Zone Editor section.
3. Locate your TXT records.
4. Check for an SPF record. It should typically look similar to v=spf1 include:_spf.google.com ~all (the exact value depends on your email provider).
5. Check for a DKIM record. This is usually a TXT record with a host name like default._domainkey.
6. Check for a DMARC record. It is usually hosted at _dmarc.yourdomain.com.au.

2. Correct misconfigured records

1. Edit the existing TXT record or add a new one if it is missing.
2. Enter the correct value provided by your email service.
3. Save the changes and allow time for DNS propagation, which can take up to 48 hours.

3. Check email blacklists

1. Visit a reputable blacklist lookup tool such as MXToolbox or MultiRBL.
2. Enter your domain name or mail server IP address.
3. Review the results to see if you are listed on any major spam databases.
4. If listed, follow the delisting instructions provided by that specific blacklist.

4. Rebuild your sender reputation

1. Send emails to known contacts and ask them to check their spam folder.
2. Instruct them to select the email and click Not spam or Not junk.
3. Avoid sending bulk emails until your deliverability has stabilised.
4. Monitor bounce messages for specific error codes related to authentication failures.

Troubleshooting

Emails are still going to spam after updating DNS

• DNS changes can take time to propagate globally. Wait 24 to 48 hours before retesting.
• Use an email header analyser to check if SPF, DKIM, and DMARC are passing on received messages.
• Confirm that the From address in your email client matches the domain you are authenticating.

DMARC reports show failures

• Temporarily change your DMARC policy to p=none while you fix authentication issues.
• Review the aggregate reports to identify which mail servers are failing authentication.
• Update your SPF record to include all legitimate mail services used by your organisation.

You suspect your domain is still compromised

• Change all email account passwords immediately.
• Enable multi-factor authentication on all mailboxes.
• Review mailbox forwarding rules for any unauthorised rules created by an attacker.
• Scan all connected devices for malware before resuming normal email use.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?