Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is it possible to secure postfix in a way, that incoming emails are checked on whether the email comes really from the sender?

Is that possible to write php script and chose a sender, like the mail is really coming from the sender and what are the possibilities for postfix to find out that this mail is not actually coming from the real sender?

What I have found out and activated are the options

smtpd_sender_restrictions = reject_unknown_sender_domain
unknown_address_reject_code = 554
smtpd_client_restrictions = reject_unknown_client
unknown_client_reject_code = 554

Please mention, whether I have missed out on any points!

share|improve this question

migrated from stackoverflow.com Jun 20 '12 at 8:18

This question came from our site for professional and enthusiast programmers.

1  
If you enable SPF and DKIM checks you may get some more assurance about this. But I'll leave it to people more proficient with postfix on how to do this. Your real problem is that SMTP does not guarantee the validity of the sender, so there may be cases where certain recipients may need to demand emails be digitally signed by the sender. –  adamo Jun 20 '12 at 8:23

1 Answer 1

Remember that SMTP mail was designed to be pretty much like regular mail. You write a message, put it in an envelope, write the recipient address on the envelope), write the sender name on the envelope, hand it over to the postman and off it goes (sorry no stamp here). Even if you write the wrong sender (purposely or not) the message will reach its recipient. What is in the envelope may not reveal the true sender.

SPF helps a lot identify the sender DOMAIN but there are no 100% guarantees. The target of SPF was pretty much SPAM rather than fix this SMTP feature. The idea behind SPF is that a domain will say which SMTP servers are valid and the recipient will have a way (DNS record) to check that information. DKIM on the other hand guarantees the source DOMAIN (not the user) by actually digitally signing the envelope/header. Digital signatures/certificates are the high price you need to pay for this. You can find information on how to implement these on the Postfix site

Of course there are countless other things that can go wrong in the above UNLESS you use encrypted communcations (like a man in the middle interception).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.