Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a host, let's call it, on which I'm running Postfix on Debian. Postfix is currently configured to do these things:

  1. All mail with as recipient is handled by this Postfix server. It forwards all such mail to my Gmail account. The firewall thus allows port 25.
  2. All mail with another domain as recipient is rejected.
  3. SPF records have been set up for the domain, saying that is the sole origin of all mail from
  4. Applications running on can connect to localhost:25 to deliver mail, with as sender.

However I recently noticed that some spammers are able to send spam to me while passing the SPF checks. Upon further inspection, it looks like they connect to my Postfix server and then say

MAIL FROM:<>     <---- this!
From: "Buy Viagra" <>   <--- and this!

How do I prevent this? I only want applications running on localhost to be able to say MAIL FROM:<>. Here's my current config (

share|improve this question
up vote 5 down vote accepted

You need the smtpd_sender_restrictions to be:

smtpd_sender_restrictions = permit_mynetworks, check_sender_access hash:/etc/postfix/notfromme

and in /etc/postfix/notfromme you put REJECT

then postmap /etc/postfix/notfromme and reload postfix.


share|improve this answer
I did this, and restarted Postfix, but it doesn't work. Postfix still lets my example session pass. – Hongli Lai Oct 14 '11 at 7:01
@HongliLai But your are not trying to telnet from localhost?! This is allowed as you requested. – mailq Oct 14 '11 at 8:50
No, I'm telnetting remotely. – Hongli Lai Oct 17 '11 at 9:54
@HongliLai I can guarantee that this works. – mailq Oct 17 '11 at 11:02
It looks like specifying in notfromme works, but and even * do not. – Hongli Lai Jul 4 '12 at 13:06

Here's my take on it:

SPFv1 protects the envelope sender address (Return-Path), not the header sender address (From). In most cases (at least that I've seen) the header sender address (From) is spoofed (as but that's not what SPFv1 is checking so therefore it passes.

share|improve this answer

I think if you add:

smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks check_helo_access hash:/etc/postfix/helo_access,

to your, and: REJECT

to /etc/postfix/helo_access, followed by "postmap helo_access" and restarting postfix, that should mean anyone identifying themselves as "" will be rejected straight out, UNLESS the connection is from the localhost in which case it will be permitted (due to permit_mynetworks ranking higher than check_helo_access).

edit - actually, that probably wouldn't help in the case that someone identifies as "HELO" and then sends mail from What you need to implement is probably header_checks:

Once you have header_checks configured for spotting mails, you should be able to configure so that anything from localhost skips these checks, and only incoming mail from other systems is checked. Then when you receive an email from from another Internet system, that should be discarded.

share|improve this answer
Unfortunately, it's quite common for spammers to send a random HELO, even when faking the server. – Tzarium Oct 13 '11 at 11:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.