<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Gadugi;
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=en-PK link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Dear Experts,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>First of all thanks for your advice , exactly you people are right that I whitelist all my domain it lets the spammers forge email address with my domain email address to get pass through.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>My MTA Postfix , IMAP Server is Cyrus, </span><span style='font-size:9.0pt;font-family:"Verdana",sans-serif;color:black'>Postfix Version: 3.1.0 </span><span lang=EN-US style='font-size:9.0pt;font-family:"Verdana",sans-serif;color:black'>, </span><span style='font-size:9.0pt;font-family:"Verdana",sans-serif;color:black'>MailScanner Version: 5.0.7</span><span lang=EN-US style='font-size:9.0pt;font-family:"Verdana",sans-serif;color:black'>, </span><span style='font-size:9.0pt;font-family:"Verdana",sans-serif;color:black'>SpamAssassin Version: 3.4.1</span><span style='font-size:13.5pt;font-family:"Verdana",sans-serif;color:black'> </span><span lang=EN-US style='mso-fareast-language:EN-US'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>My scenario is that my Email server is hosted internally at Private ip address range . My TXT Record at public dns is for my public faced IP address.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Issue is that when I send email at GMAIL,Yahoo,Hotmail etc my SPF is valid as shown at their received email headers. SPF is valid checked at MXTOOLS as well.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>But my own mailscanner says SPF Fails may be because email server ip is private and TXT record is for mail server public faced IP. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>I am doing all this SPF check to get rid of spoofed emails that using my domain address so I have whitelisted my internal network and host:mydomain <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>How to get rid of this SPF fail on my own mailscanner so that my own emails not get high score ?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Any other solution to prevent Email spoofing ?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'> <o:p></o:p></span></p><p class=MsoNormal><span lang=en-PK style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><p class=MsoNormal style='line-height:90%'><b><span lang=en-PK style='line-height:90%;font-family:"Gadugi",sans-serif;color:#13A538'>Bilal Ahmad</span></b><span lang=en-PK><o:p></o:p></span></p><p class=MsoNormal style='line-height:90%'><span lang=en-PK style='font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:#203478'>Network Administrator<o:p></o:p></span></p><p class=MsoNormal style='line-height:90%'><span lang=en-PK style='font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:#203478'>Cell: +92 333 7451870 </span><span lang=en-PK style='font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:red'>|</span><span lang=en-PK style='font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:#203478'> Tel: +92 68 5882400 </span><span lang=en-PK style='font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:red'>|</span><span lang=en-PK style='font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:#203478'> Ext. 2499<o:p></o:p></span></p><p class=MsoNormal style='line-height:90%'><span lang=en-PK style='font-size:10.0pt;line-height:90%;font-family:"Gadugi",sans-serif;color:#203478'>www.kfueit.edu.pk<o:p></o:p></span></p><p class=MsoNormal><span lang=en-PK><o:p> </o:p></span></p></div><p class=MsoNormal><span lang=en-PK style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US>From:</span></b><span lang=EN-US> MailScanner <mailscanner-bounces+bilal.ahmed=kfueit.edu.pk@lists.mailscanner.info> <b>On Behalf Of </b>David Jones via MailScanner<br><b>Sent:</b> Monday, 6 May 2019 10:39 AM<br><b>To:</b> MailScanner Discussion <mailscanner@lists.mailscanner.info><br><b>Cc:</b> David Jones <djones@ena.com><br><b>Subject:</b> Re: Email SPoofing Block Help with SPF in Mailscanner<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal><span style='font-size:12.0pt;color:black'>Martin,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;color:black'>I knew you wouldn't have done that which is why I removed your name from the top of the reply. My response was for the OP and others that might have done that. :)<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;color:black'>Dave<o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='font-size:12.0pt;color:black'><o:p> </o:p></span></p></div><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="98%" align=center></div><div id=divRplyFwdMsg><p class=MsoNormal><b><span style='color:black'>From:</span></b><span style='color:black'> MailScanner <<a href="mailto:mailscanner-bounces+djones=ena.com@lists.mailscanner.info">mailscanner-bounces+djones=ena.com@lists.mailscanner.info</a>> on behalf of Martin Hepworth <<a href="mailto:maxsec@gmail.com">maxsec@gmail.com</a>><br><b>Sent:</b> Sunday, May 5, 2019 10:47 AM<br><b>To:</b> MailScanner Discussion<br><b>Subject:</b> Re: Email SPoofing Block Help with SPF in Mailscanner</span> <o:p></o:p></p><div><p class=MsoNormal> <o:p></o:p></p></div></div><div><div><div><p class=MsoNormal>Was a question not an instruction, the whitelist of your own domain is a common configuration error and will make sure spoofed emails allegedly from your own domain will get through.<o:p></o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Martin<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Sun, 5 May 2019 at 14:45, David Jones via MailScanner <<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><p class=MsoNormal style='margin-bottom:12.0pt'>Never, ever, ever whitelist either in MailScanner or SpamAssassin any <br>domains that your MTA is configured to accept. This will definitely let <br>spoofed emails through.<br><br>> On Sat, 4 May 2019 at 20:38, <<a href="mailto:bilal.ahmed@kfueit.edu.pk" target="_blank">bilal.ahmed@kfueit.edu.pk</a> <br>> <mailto:<a href="mailto:bilal.ahmed@kfueit.edu.pk" target="_blank">bilal.ahmed@kfueit.edu.pk</a>>> wrote:<br>> <br>> Kindly I need a help someone is spoofing address of my domain and<br>> forwarding email to my own domain.____<br>> <br><br>We need an example email with headers lightly redacted posted to <br>someplace like <a href="http://pastebin.com" target="_blank">pastebin.com</a>. It would also help to see the maillog <br>entries for that queue ID.<br><br>There are multiple ways to block this based on the email headers.<br><br>We aren't even sure what domain to check the SPF record for without any <br>headers.<br><br>You should consider setting these values in MailScanner.conf if not <br>already to help with troubleshooting:<br><br>Add Envelope From Header = yes<br>Detailed Spam Report = yes<br>Include Scores In SpamAssassin Report = yes<br>Always Include SpamAssassin Report = yes<br>Spam Score = yes<br><br>These must be on based on what information you provided but make sure:<br>Spam Checks = yes<br>Use SpamAssassin = yes<br><br>> My SPF is already added in Public DNS.____<br>> <br><br>Your own SPF setting in DNS will help prevent spoofing to others but <br>will not necessarily help spoofing to your own mail server running <br>MailScanner/SpamAssassin depending on your mail flow setup. For <br>example, does outbound mail flow for your domain go through this same <br>mail server unauthenticated from an internal mail server? Does an <br>internal mail server smarthost to or run locally on this MailScanner <br>instance?<br><br>If your outbound mail does not go through this MailScanner instance, <br>then you have options like this in your /etc/mail/spamassassin/<a href="http://local.cf" target="_blank">local.cf</a> <br>or /etc/mail/spamassassin/<a href="http://mailscanner.cf" target="_blank">mailscanner.cf</a>:<br><br>blacklist_from *@<a href="http://yourdomain.com" target="_blank">yourdomain.com</a><br><br>It appears that your outbound mail does flow through this MailScanner <br>box based on the "score SPF_FAIL 15.0" so the entry above would block <br>legit email just like the "score SPF_FAIL 15.0" entry.<br><br>You might be able to add this to the etc/mail/spamassassin/<a href="http://local.cf" target="_blank">local.cf</a> or <br>/etc/mail/spamassassin/<a href="http://mailscanner.cf" target="_blank">mailscanner.cf</a>:<br><br>whitelist_from_rcvd *@<a href="http://yourdomain.com" target="_blank">yourdomain.com</a> [ip.add.re.ss]<br><br>where the "ip.add.re.ss" is the internal IP address of your mail server. <br> Note this is not ideal since you will no longer be filtering outbound <br>email.<br><br>NOTE: this would only be temporary until a better solution is determined <br>after seeing the email headers of a spoofed email and knowing more about <br>the mail flow.<br><br>> __ __<br>> <br>> Please Any solution to block invalid SPF record address in my<br>> Mailscanner/spamassasian.____<br>> <br><br>Please provide more detail. Mail filtering is very complex so we can't <br>help without details.<br><br>- original email lightly redacted posted to <a href="http://pastebin.com" target="_blank">pastebin.com</a><br>- what is the MTA?<br>- what RBLs are configured in the MTA?<br>- version of MailScanner<br>- version of SpamAssassin<br><br>> Because I have seen the spoof address with no SPF record are passing<br>> through Mainscanner.____<br>> <br><br>This may be more of a question for the SpamAssassin Users mailing list <br>if MailScanner is properly using SpamAssassin.<br><br>-- <br>David Jones<br><br><br>-- <br>MailScanner mailing list<br><a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><o:p></o:p></p></blockquote></div></div><p class=MsoNormal>-- <o:p></o:p></p><div><p class=MsoNormal>-- <br>Martin Hepworth, CISSP<br>Oxford, UK<o:p></o:p></p></div></div></div></div></body></html>