How to reject/detect emails claiming to be from my own domain?

Dave Jones dave at jonesol.com
Sat Dec 24 01:10:56 UTC 2016


This one is going to be tough.  It would be best to do this at the MTA and
not in SA since SA only works with the visible From: (header) address and
not the envelope-from that the MTA has access to.  The envelope-from is
what SPF checks and DMARC checks the visible From: header.

Assuming that all legit mail from your own domain comes from
trusted/internal networks by your MTA, you could put a block on the
envelope-from address having your own domain.  In Postfix this is fairly
easy since you can order the checks the way you need them.  Standard
practice is to allow your networks first then do sender checks later which
would handle this scenario.

I switched from sendmail to Postfix about 5 years ago and haven't looked
back.  So many things that required milters in sendmail were built-in to
Postfix.  I never liked dealing with the sendmail config file either.
Switching from sendmail to Postfix is not that hard to do basic mail flow
but it takes some time to wrap your head around the advanced Postfix
settings since it's so flexible.

If you want to look at an example config, take a look at the EFA project
which is a prebuilt VM image with MailScanner, Mailwatch, and pretty good
default Postfix settings to get started with.
https://efa-project.org/

Dave

On Fri, Dec 23, 2016 at 3:06 PM, Jason Waters <jason at geeknocity.com> wrote:

> What do you use for an MTA?  I know with postfix you can use some smtp
> restrictions to solve this problem.
>
> On Fri, Dec 23, 2016 at 3:00 PM, Philip Parsons <pparsons at techeez.com>
> wrote:
>
>> I use Mailscanner and Send mail.  We have a few instances that we are
>> receiving spam from jack at example.com to jack at example.com and it is
>> getting through.  I have not seemed to find and answers as to how to stop
>> this? Anyone got an Idea.  We already have SPF setup which helps but is not
>> fully for this situation.
>>
>>
>>
>>
>>
>> Thank you.
>> Philip Parsons
>>
>>
>>
>>
>>
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>>
>>
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20161223/9b03ddca/attachment.html>


More information about the MailScanner mailing list