Issue email@domain[com] <notification@domain[com]> someone is sending mail to our email (Fake emails)

[cloudbridge]

Hello, so I don't know how to explain everything, but there is problem with one server and one domain on it.
We have domain domain.com and it has email@domain.com
Someone is sending us fake emails width pdf attachments.pdf.htm to our original email@domain.com from fake notification@domain.com
notification@domain.com doesn't exist.
Plesk mail server outgoing mail mode setting is: Send from domain IP addresses
-------------------------------------------------------------------------------------
From: "email@domain.com" <NOTIFICATION@domain.com>
Date: 2020 September 2 12:01:00 EEST
To: email@domain.com
Subject: New Order

FYI
-------------------------------------------------------------------------------------

Could someone advise me how it could happen?
That domain.com email is set on outlook on 3 pcs.

 

[pleskpanel]

You can start by first checking the headers of the spoofed email to see if the original sending IP is actually your server. If you confirm that it's not, then consider using SPF to help combat message spoofing.

 

[cloudbridge]

You can start by first checking the headers of the spoofed email to see if the original sending IP is actually your server. If you confirm that it's not, then consider using SPF to help combat message spoofing.

Ok thanks will check it... Generated SPF record..was missing it.