Service Desk spoofing out emails

Question

We have noticed that some incoming email from Atlassian for Jira ticket response notifications are attempting to spoof the respondents’ email addresses from our  domain.

In an attempt to temporarily allow these spoofed emails to reach use, we added _spf.atlassian.net to our SPF record. However, the source IP addresses of the incoming spoof email does not match any of the IP ranges included in _spf.atlassian.net.

We would like to stop Jira from spoofing our domain. If this is not possible, we need to know the correct information to add to our SPF record.

Angélica Luz · Answer

Hi Frank,

I've searched more about these emails that you are receiving, and it looks like your instance is being affected by a bug:

- https://jira.atlassian.com/browse/JRACLOUD-69423

Please, click on vote and watch to receive updates about the bug, that it's almost resolved.

Regards,
Angélica

Frank Perez · Answer

Thank you, Angélica.

If Atlassian is using those IP's for outbound email, they should add them to their SPF record (_spf.atlassian.net), especially if they are spoofing customer domains, as in our case.

How can we get Jira/Atlassian to stop spoofing us?

Thanks.

Angélica Luz · Answer

Hi Frank,

Thank you for the details.
I've checked the screenshot and validated that those IPs are listed as "Outbound email" on our documentation, so you should allow those IP ranges.

Here it shows the list:

- Atlassian Cloud IP ranges and domains

Can you please test and let us know if it works?

Regards,
Angélica