While looking at traffic from Unidentified Senders, you may come across various ladwp.com hostnames that are sending mail on behalf of your organization's domains, like in the below example.



The ladwp.com domain is owned by the Los Angeles Department of Water & Power. Due to a potential security breach in their email environment, it appears that malicious third parties are able to use their email gateway to spoof domains owned by other organizations.


Valimail has informed the Los Angeles Department of Water & Power about this potential security breach several times, but we have not received a response on this matter.


If your domain is actively being spoofed, the best course of action is to make sure your domain's DMARC policy is set to Quarantine or Reject.