Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In short:

What happens: FROM: header is forged, SENDER: is legit , spam is delivered.
What I need: Detect forged FROM: header when possible, block delivery


I have a exim server that receives/sends mails for my clients. I activated both SPF & DKIM for my client but from what I researched SPF checks only the envelope SENDER.

How can I make exim execute the same SPF validation steps on the FROM: header?
Or do you have other ideeas on how to solve this problem.?

Example of message that ended in inbox:

Return-path: <>
Delivery-date: Wed, 16 May 2012 22:51:37 +0300
Received: from ([]:3344)
        by with esmtp (Exim 4.77)
        (envelope-from <>)
        id 1SUkG0-0006yl-SG
        for; Wed, 16 May 2012 22:51:37 +0300
Received: from apache by with local (Exim 4.67)
        (envelope-from <<>>)
        id VF1VAG-QZSQV9-C6
        for <>; Wed, 16 May 2012 20:51:36 +0100
To: <>
Subject: We invite you to work in your spare time for $ 100 per hour
X-PHP-Script: for
From: <>
X-Sender: <>
X-Mailer: PHP
X-Priority: 1
Content-Type: text/plain; charset="iso-8859-2"
Message-Id: <>
share|improve this question
edited title to be more relevant – catalint May 17 '12 at 10:25
If your problem is that people can lie about who wrote something, the answer is that no solution is known. At least you can validate who sent it from you. If the problem is that you can't reliably detect 100% of spam -- again, no solution is known. – David Schwartz May 17 '12 at 11:08
up vote 3 down vote accepted

This is undesirable for a number of reasons; here's one. I have SPF records set up for my domain. If I send email to a legitimate mailing list to which you subscribe, the mailing list server will send that out to all list recipients with my From: line still in place. If you test the From: header, with my domain in it, against my SPF records, you'll get a FAIL, because I don't list the mail servers for every list I subscribe to in my SPF records, and nor should I. So you'll reject the email; that would be bad, so you probably don't want to do that.

share|improve this answer
U are right, haven't thought of that. – catalint May 17 '12 at 10:21
Maybe you have other ideeas for my problem to be solved ? – catalint May 17 '12 at 10:22
i can't vote up your answer :( don't have the rep – catalint May 17 '12 at 10:25
But you can accept it, by clicking the "tick" outline next to it; this is something you should do for any question you ask, when you're happy with an answer. It drives the SF reputation system. – MadHatter May 17 '12 at 10:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.