Exim Spam - spoofing From: same as To:

ergotron · 03-05-2009, 11:40 AM

I have an Exim4 installation on Debian and have noticed the last few months a sharp rise in spam where the From: is spoofing the To: and bypasses my reverse dns checking. He'here's an example:

2009-03-05 03:52:06 1Lf9JB-00049c-Sl <= shadow@<mydomain>.ca H=82-135-198-57.static.zebra.lt [82.135.198.57] P=smtp S=3389
2009-03-05 03:52:06 1Lf9JB-00049c-Sl => blackhole (local_scan discarded recipients)

I have the reverse dns checking setup and it works very well but somehow when it claims to be an email from my domain it gets by. The only thing to catch it is spamassassin which blackholes it.

Another example:

2009-03-05 10:52:39 1LfFs7-0004Yc-CV <= postmaster@<mydomain>.ca H=adsl-89-132-26-102.monradsl.monornet.hu [89.132.26.102] P=smtp S=5661
2009-03-05 10:52:39 1LfFs7-0004Yc-CV => blackhole (local_scan discarded recipients)

Is there a way to stop this spoofing or reject it the same way reverse dns checking does for fake domains?

norobro · 03-05-2009, 02:14 PM

I recently had what I thought was an exim relay problem (link). Turned out to be something else.

Anyway, in my searching for a solution I found this on the Exim forum.

HTH

Norm