<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Gadugi;
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Assuming that you have access to your postfix server, I’d block SPF there rather than in spamassassin. Maybe consider installing postfix-policyd-spf-python. Any domains that are configured to hard-fail will
be dealt with there, saving processing time. A soft fail will be passed through to normal spam filtering. If you wish to use spf in conjunction with spamassassin you’ll still have that flexibility. Since your domain is set to hard-fail, those spoofed messages
will never see the light of day. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#1F497D">...Kevin<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">--<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Kevin Miller<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Network/email Administrator, CBJ MIS Dept.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">155 South Seward Street<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Juneau, Alaska 99801<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Phone: (907) 586-0242, Fax: (907) 586-4588 Registered Linux User No: 307357<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> MailScanner <mailscanner-bounces+kevin.miller=juneau.org@lists.mailscanner.info>
<b>On Behalf Of </b>bilal.ahmed@kfueit.edu.pk<br>
<b>Sent:</b> Monday, May 06, 2019 7:26 AM<br>
<b>To:</b> 'MailScanner Discussion' <mailscanner@lists.mailscanner.info><br>
<b>Subject:</b> RE: Email SPoofing Block Help with SPF in Mailscanner<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Dear Experts,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">First of all thanks for your advice , exactly you people are right that I whitelist all my domain it lets the spammers forge email address with my domain email address to get pass through.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My MTA Postfix , IMAP Server is Cyrus, <span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:black">Postfix Version: 3.1.0 </span><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:black">,
</span><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:black">MailScanner Version: 5.0.7</span><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:black">,
</span><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:black">SpamAssassin Version: 3.4.1</span><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal">My scenario is that my Email server is hosted internally at Private ip address range . My TXT Record at public dns is for my public faced IP address.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Issue is that when I send email at GMAIL,Yahoo,Hotmail etc my SPF is valid as shown at their received email headers. SPF is valid checked at MXTOOLS as well.<o:p></o:p></p>
<p class="MsoNormal">But my own mailscanner says SPF Fails may be because email server ip is private and TXT record is for mail server public faced IP.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am doing all this SPF check to get rid of spoofed emails that using my domain address so I have whitelisted my internal network and host:mydomain
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">How to get rid of this SPF fail on my own mailscanner so that my own emails not get high score ?<o:p></o:p></p>
<p class="MsoNormal">Any other solution to prevent Email spoofing ?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="line-height:90%"><b><span style="font-family:"Gadugi",sans-serif;color:#13A538">Bilal Ahmad</span></b><o:p></o:p></p>
<p class="MsoNormal" style="line-height:90%"><span style="font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:#203478">Network Administrator<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:90%"><span style="font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:#203478">Cell: +92 333 7451870
</span><span style="font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:red">|</span><span style="font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:#203478"> Tel: +92 68 5882400
</span><span style="font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:red">|</span><span style="font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:#203478"> Ext. 2499<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:90%"><span style="font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:#203478"><a href="http://www.kfueit.edu.pk">www.kfueit.edu.pk</a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> MailScanner <<a href="mailto:mailscanner-bounces+bilal.ahmed=kfueit.edu.pk@lists.mailscanner.info">mailscanner-bounces+bilal.ahmed=kfueit.edu.pk@lists.mailscanner.info</a>>
<b>On Behalf Of </b>David Jones via MailScanner<br>
<b>Sent:</b> Monday, 6 May 2019 10:39 AM<br>
<b>To:</b> MailScanner Discussion <<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a>><br>
<b>Cc:</b> David Jones <<a href="mailto:djones@ena.com">djones@ena.com</a>><br>
<b>Subject:</b> Re: Email SPoofing Block Help with SPF in Mailscanner<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Martin,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">I knew you wouldn't have done that which is why I removed your name from the top of the reply. My response was for the OP and others that might have done that. :)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Dave<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> MailScanner <<a href="mailto:mailscanner-bounces+djones=ena.com@lists.mailscanner.info">mailscanner-bounces+djones=ena.com@lists.mailscanner.info</a>> on behalf of
Martin Hepworth <<a href="mailto:maxsec@gmail.com">maxsec@gmail.com</a>><br>
<b>Sent:</b> Sunday, May 5, 2019 10:47 AM<br>
<b>To:</b> MailScanner Discussion<br>
<b>Subject:</b> Re: Email SPoofing Block Help with SPF in Mailscanner</span> <o:p>
</o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal">Was a question not an instruction, the whitelist of your own domain is a common configuration error and will make sure spoofed emails allegedly from your own domain will get through.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Martin<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Sun, 5 May 2019 at 14:45, David Jones via MailScanner <<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:12.0pt">Never, ever, ever whitelist either in MailScanner or SpamAssassin any
<br>
domains that your MTA is configured to accept. This will definitely let <br>
spoofed emails through.<br>
<br>
> On Sat, 4 May 2019 at 20:38, <<a href="mailto:bilal.ahmed@kfueit.edu.pk" target="_blank">bilal.ahmed@kfueit.edu.pk</a>
<br>
> <mailto:<a href="mailto:bilal.ahmed@kfueit.edu.pk" target="_blank">bilal.ahmed@kfueit.edu.pk</a>>> wrote:<br>
> <br>
> Kindly I need a help someone is spoofing address of my domain and<br>
> forwarding email to my own domain.____<br>
> <br>
<br>
We need an example email with headers lightly redacted posted to <br>
someplace like <a href="http://pastebin.com" target="_blank">pastebin.com</a>. It would also help to see the maillog
<br>
entries for that queue ID.<br>
<br>
There are multiple ways to block this based on the email headers.<br>
<br>
We aren't even sure what domain to check the SPF record for without any <br>
headers.<br>
<br>
You should consider setting these values in MailScanner.conf if not <br>
already to help with troubleshooting:<br>
<br>
Add Envelope From Header = yes<br>
Detailed Spam Report = yes<br>
Include Scores In SpamAssassin Report = yes<br>
Always Include SpamAssassin Report = yes<br>
Spam Score = yes<br>
<br>
These must be on based on what information you provided but make sure:<br>
Spam Checks = yes<br>
Use SpamAssassin = yes<br>
<br>
> My SPF is already added in Public DNS.____<br>
> <br>
<br>
Your own SPF setting in DNS will help prevent spoofing to others but <br>
will not necessarily help spoofing to your own mail server running <br>
MailScanner/SpamAssassin depending on your mail flow setup. For <br>
example, does outbound mail flow for your domain go through this same <br>
mail server unauthenticated from an internal mail server? Does an <br>
internal mail server smarthost to or run locally on this MailScanner <br>
instance?<br>
<br>
If your outbound mail does not go through this MailScanner instance, <br>
then you have options like this in your /etc/mail/spamassassin/<a href="http://local.cf" target="_blank">local.cf</a>
<br>
or /etc/mail/spamassassin/<a href="http://mailscanner.cf" target="_blank">mailscanner.cf</a>:<br>
<br>
blacklist_from *@<a href="http://yourdomain.com" target="_blank">yourdomain.com</a><br>
<br>
It appears that your outbound mail does flow through this MailScanner <br>
box based on the "score SPF_FAIL 15.0" so the entry above would block <br>
legit email just like the "score SPF_FAIL 15.0" entry.<br>
<br>
You might be able to add this to the etc/mail/spamassassin/<a href="http://local.cf" target="_blank">local.cf</a> or
<br>
/etc/mail/spamassassin/<a href="http://mailscanner.cf" target="_blank">mailscanner.cf</a>:<br>
<br>
whitelist_from_rcvd *@<a href="http://yourdomain.com" target="_blank">yourdomain.com</a> [ip.add.re.ss]<br>
<br>
where the "ip.add.re.ss" is the internal IP address of your mail server. <br>
Note this is not ideal since you will no longer be filtering outbound <br>
email.<br>
<br>
NOTE: this would only be temporary until a better solution is determined <br>
after seeing the email headers of a spoofed email and knowing more about <br>
the mail flow.<br>
<br>
> __ __<br>
> <br>
> Please Any solution to block invalid SPF record address in my<br>
> Mailscanner/spamassasian.____<br>
> <br>
<br>
Please provide more detail. Mail filtering is very complex so we can't <br>
help without details.<br>
<br>
- original email lightly redacted posted to <a href="http://pastebin.com" target="_blank">
pastebin.com</a><br>
- what is the MTA?<br>
- what RBLs are configured in the MTA?<br>
- version of MailScanner<br>
- version of SpamAssassin<br>
<br>
> Because I have seen the spoof address with no SPF record are passing<br>
> through Mainscanner.____<br>
> <br>
<br>
This may be more of a question for the SpamAssassin Users mailing list <br>
if MailScanner is properly using SpamAssassin.<br>
<br>
-- <br>
David Jones<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><o:p></o:p></p>
</blockquote>
</div>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<p class="MsoNormal">-- <br>
Martin Hepworth, CISSP<br>
Oxford, UK<o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>