Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting a high value of spam with the sender faked as my own email address i.e. from

Now all emails from my domain are sent using a particular server. How can I setup a procmail filter (or other filter) to delete all emails purporting to originate from which are not sent through this particular SMTP server?

Or perhaps there's a better way to do this with the SMTP server itself (postfix).

EDIT: the spam is coming from multiple SMTP servers. I guess I just want a rule to say if there is an email of the form and it does not come from SMTP server, then the email should be blocked.

EDIT: I'll go with the SPF option, though if someone can also show how it can be done with procmail, I would be interested to learn this also.

share|improve this question
up vote 0 down vote accepted

SPF, DKIM are designed to stop this sort of thing. You can block those mails at MTA level without accepting them using either SPF or DKIM

share|improve this answer
Thanks. I may end up implementing SPF, but was hoping there might be an easier 'quick fix' solution. – bugmenot77 Jul 23 '10 at 9:27

If you know it's only a single SMTP server (and single IP) that you want to block, I'd suggest using iptables or something like that. Better to prevent the e-mail from even being processed by the server. You can do that with a line like this:

iptables -A INPUT -s -j DROP

Keep in mind though, that this won't prevent the spoofed e-mail. It will only prevent that particular server (IP) from sending you anything.

Edit: Ah, apparently I really misread "particular SMTP server." Another quick solution using procmail like you suggested can be found here. You can pull the IP address into a variable, and then use that in the procmail recipe to check against your server's IP. This is definitely just the "quick-fix" solution, as topdog's answer about SPF is the more robust solution.

share|improve this answer
The spam isn't coming from a single SMTP server. – bugmenot77 Jul 23 '10 at 9:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.