postfix - how to block forged sender e-mail addresses

ddaas · 02-02-2009, 03:16 PM

Hi there,
I've managed to get rid of most of the spams using different postfix restrictions.
There are a lot of spams with the sender from one of my domains.
I'm using virtual domains.

How can I block e-mails that are coming from a remote smtp server and the sender belongs to one of the virtual domains?

Thanks

gilead · 02-02-2009, 07:13 PM

If you administer the DNS server that resolves your domains you could use SPF to restrict who can send using your domain.

There are situations where this won't work though so it's worth reading the docs first, although it's possible I've just done it wrong. My setup where my external DNS is at dyndns.com doesn't work for me.

ddaas · 02-03-2009, 07:41 AM

ok, but there isn't something more simple. Maybe a postfix restriction that denies e-mails from remote smtp servers if the sender belongs to a local domain?

ddaas · 02-06-2009, 10:32 AM

nobody is getting these kind of spams?

auximini · 02-06-2009, 02:06 PM

If you're talking about Backscatter spam (where your users are receiving bounces of spam because they are listed as the From field), there is a whole section about this on the Postfix site:

http://www.postfix.org/BACKSCATTER_README.html

I personally haven't used any of the methods yet, but this might be what you're looking for.

gilead · 02-06-2009, 02:12 PM

The risk with stopping remote domains sending as your domain is that mobile users who temporarily use a different SMTP server can be blocked. That's the reason for the SPF stuff, to allow specific domains to do this.

Between spam-assassin and clamav my users get almost no dodgy emails. Apart from checking the spam folders to train spam-assassin it's a low maintenance way to do it.

ddaas · 02-07-2009, 03:14 AM

Quote:

Originally Posted by gilead

The risk with stopping remote domains sending as your domain is that mobile users who temporarily use a different SMTP server can be blocked. That's the reason for the SPF stuff, to allow specific domains to do this.

Between spam-assassin and clamav my users get almost no dodgy emails. Apart from checking the spam folders to train spam-assassin it's a low maintenance way to do it.

Ok, I understand that. In my particular case and on my server there are no mobile users. Every user is sending email using the same server.
I remember that I've read about a postfix restriction that blocks that kind of spams. But I can't remember and also I can't find it anymore.

gilead · 02-07-2009, 01:51 PM

Does the info here help at all? I did some searches for blocking domain spoofing with postfix, but since I'm not running postfix here I didn't know which would most likely be useful.

ddaas · 02-08-2009, 02:19 AM

Quote:

Originally Posted by gilead

Does the info here help at all? I did some searches for blocking domain spoofing with postfix, but since I'm not running postfix here I didn't know which would most likely be useful.

thank you ! that was what I was looking for