currently, i find myself in the situation where once Postfix 2.11 has been configured to properly reject outbound forged emails addresses when sender login mismatches and also when sender address does not owns login address. The from/sender email address is usually able to be changed through email clients Identity edition feature.
So, to prevent sender email address forgering i mainly setup the following rules:
## Here we get email addres. smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql_sender_login_maps.cf smtpd_sender_restrictions = ... reject_unlisted_sender, reject_authenticated_sender_login_mismatch, ...
Through the previous settings i'm able to reject emails when sender email address does not match above requirements once Identity has been edited through Identity edition tool which comes with Roundcube, Mozilla Thunderbird, etc. Right here things are perfect.
Bellow is the output shown at mail.log
Note: firstname.lastname@example.org is the sender address i do not own and which must be correctly rejected while email@example.com is the real/good sender address used to authenticate. And the one which should always be used for sending reasons. <firstname.lastname@example.org>: Sender address rejected: not owned by user sender@login-domain; from=<email@example.com> to=<firstname.lastname@example.org> proto=ESMTP helo=<host.example.es>
Here is the complete mail.log output:
Although previous scenario seems to work fine there's really an issue or uncontrolled use case which happens when Identity is edited through AfterLogic Webmail client. When sender address has been editted through AfterLogic, once the email is sent, the from address which seems to be used for sending purposes - looking at mail.log - is email@example.com but then looking at the log you also can see new firstname.lastname@example.org address appears at opendkim mail.log line and also in the headers once the email is sent. So somewhere email@example.com is used as from: address but it looks transparent at mail.log file.
Here's what can be seen:
opendkim: 72C664232B: no signing table match for 'firstname.lastname@example.org'
Here is the complete log output
Here there are email headers, once the email has been received at Google Apps.
You can see from: belongs to email@example.com while return-path belongs to the login/authentication address.
From: "test" <firstname.lastname@example.org>
The following Gist is the current Postfix configuration, without edits.
Does anyone knows what's going on and how to solve that issue?
Thanks in advanced!