@intelisense Oh and sorry for the second message I forgot the last part of your message. Here’s the DMARC record, I’ve been using it for months now:
_dmarc.villisek.fr. 900 IN TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@villisek.fr,mailto:b377e11c@mxtoolbox.dmarc-report.com; ruf=mailto:postmaster@villisek.fr,mailto:b377e11c@forensics.dmarc-report.com; rf=afrf; sp=quarantine; fo=0:1:d:s; pct=100; adkim=r; aspf=s"
Hi, thank you for the answer, and sorry for the late reply :( …
I analysed the logs thoroughly, and I can confirm my SMTP server hasn’t sent any email aside the legitimate ones.
And u/voracitude 's answer confirmed my thoughts, being that the emails were sent from somewhere else.
I don’t think it’s that much unusual to use a “small” domain for spoofing: SMEs are “easy targets” usually, and if the recipient’s anti-spam isn’t configured properly then the attackers could benefit from a domain which may be small but has a good reputation.