Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a bunch of domains as relay domains at my sendmail config, i noticed that some dirty botnet is using dns spoof to be able to send emails using those relay domains.

How it works:

a domain zzz.xxx.tld resolves back to 127.0.0.1, when my server tries to resolve zzz.xxx.tld it falls back to 127.0.0.1 spoof!

Is there anyway to fix/avoid/block this? relaying only on specific server ips would be better?

Thanks.

share|improve this question

1 Answer 1

Do you need to have a hosts entry pointing to 127.0.0.1? Perhaps you could point the hosts to your external IP instead and only allow relaying from localhost.

share|improve this answer
    
I'm not sure what are the implications of not relaying on 127.0.0.1, some emails are sent by crons and other server internals, not sure if those would be delivered or deferred. –  Rodrigo Aug 23 '10 at 21:58
    
It mainly depends on the SMTP address they're using, if they're using the external IP or a hostname other than localhost, then that change would break them. –  James Lawrie Aug 23 '10 at 22:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.