Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In short:

What happens: FROM: header is forged, SENDER: is legit , spam is delivered.
What i need: Detect forged FROM: when possible, block delivery

Explained:

I have a exim server (on cpanel install) that receives/sends mails for my clients.
I activated both SPF & DKIM for my client but from what i researched SPF checks only the envelope SENDER: :(

How can I make exim execute the same SPF validation steps on the FROM: header ?
Or do you have other ideeas on how to solve this problem.?

Example of message that ended in inbox:

Return-path: <stupendouslylq@ritenour.k12.mo.us>
Envelope-to: office@myclient.ro
Delivery-date: Wed, 16 May 2012 22:51:37 +0300
Received: from 173.137.18.95.dynamic.jazztel.es ([95.18.137.173]:3344)
        by genius.filipnet.ro with esmtp (Exim 4.77)
        (envelope-from <stupendouslylq@ritenour.k12.mo.us>)
        id 1SUkG0-0006yl-SG
        for office@myclient.ro; Wed, 16 May 2012 22:51:37 +0300
Received: from apache by ncjobbbneebppofandpfe.nobleenergyinc.com with local (Exim 4.67)
        (envelope-from <<office@myclient.ro>>)
        id VF1VAG-QZSQV9-C6
        for <office@myclient.ro>; Wed, 16 May 2012 20:51:36 +0100
To: <office@myclient.ro>
Subject: We invite you to work in your spare time for $ 100 per hour
X-PHP-Script: ncjobbbneebppofandpfe.greaterlouisville.com/sendmail.php for 95.18.137.173
From: <office@myclient.ro>
X-Sender: <office@myclient.ro>
X-Mailer: PHP
X-Priority: 1
Content-Type: text/plain; charset="iso-8859-2"
Message-Id: <Y87CJM-XJEZZ1-VU@ncjobbbneebppofandpfe.lsinter.net>

10x for reading!

share|improve this question
    
edited title to be more relevant –  catalint May 17 '12 at 10:25
1  
If your problem is that people can lie about who wrote something, the answer is that no solution is known. At least you can validate who sent it from you. If the problem is that you can't reliably detect 100% of spam -- again, no solution is known. –  David Schwartz May 17 '12 at 11:08
add comment

1 Answer

up vote 3 down vote accepted

This is undesirable for a number of reasons; here's one. I have SPF records set up for my domain. If I send email to a legitimate mailing list to which you subscribe, the mailing list server will send that out to all list recipients with my From: line still in place. If you test the From: header, with my domain in it, against my SPF records, you'll get a FAIL, because I don't list the mail servers for every list I subscribe to in my SPF records, and nor should I. So you'll reject the email; that would be bad, so you probably don't want to do that.

share|improve this answer
    
U are right, haven't thought of that. –  catalint May 17 '12 at 10:21
    
Maybe you have other ideeas for my problem to be solved ? –  catalint May 17 '12 at 10:22
    
i can't vote up your answer :( don't have the rep –  catalint May 17 '12 at 10:25
    
But you can accept it, by clicking the "tick" outline next to it; this is something you should do for any question you ask, when you're happy with an answer. It drives the SF reputation system. –  MadHatter May 17 '12 at 10:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.