Tag Info

New answers tagged

0

A properly implemented SPF checker will short-circuit on a mechanism match and the check_host() function will return the qualifier value as the result. I don't have any "real world" data to provide to you regarding whether or not most email servers follow the RFC or not. Source: RFC7208 (see page 17)


5

RFC 7208 § 5.1 is explicit about this: after all appears, everything after it MUST be ignored. Mechanisms after "all" will never be tested. Mechanisms listed after "all" MUST be ignored. Any "redirect" modifier (Section 6.1) MUST be ignored when there is an "all" mechanism in the record, regardless of the relative ordering of the terms. The RFC ...


2

"v=spf1 include:_spf.google.com ~all a mx ip4:X.X.0.0/23 include:spf.example.com ?all" says in order: "email coming from _spf.google.com is valid for our domain" "softfail on all other senders for our domain" "email coming from our a records are valid for our domain" "email coming from our mx records are valid for our domain" "email ...


0

RBLs in general provide a valuable service, but Spamrats use a blunderbuss where a pea-shooter would be more appropriate. They block not just an offender's ip address but the entire class C address range that the offender comes from. This is not the way responsible RBL providers behave and I for one wouldn't choose to use this outfit at all. Just so you know ...


1

I fixed this by adding a new high-cost MX record for the domain at 1.2.3.4, which pointed to the mail server for 2.3.4.5. This ensures that the reverse DNS matches the forward DNS. This is basically a quick fix to get around the sendmail issue below. I did find out some useful stuff about Hotmail and Outlook along the way, and what causes mails to be ...


2

RATS-Dyna means an IP range not a single IP address. It is for spammy neighborhoods. So check who is in charge of that range. The provider of the range needs to address the individual users. RATS-NoPtr - Means that your domain and IP reverse lookup are properly set. Which is a good thing. In your case you have everything setup correctly but your IP ...


1

I came across this old post while researching the same issue. Here's MS's answer: https://technet.microsoft.com/en-us/library/bb125259%28v=exchg.141%29.aspx Set-SenderIDConfig -BypassedRecipients kim@contoso.com,john@contoso.com Set-SenderIDConfig -BypassedSenderDomains fabrikam.com


2

hazymat, I'm sure you don't want to hear this but... You are the problem, not Postfix Waiting till someone detects the SPAM is not a viable way to manage a computer system. If you owned a rifle and left it on your dront doorstep, would you wait for the police to come calling before you checked it had gone missing? at least 20% of the websites ...


7

You can block all outgoing SMTP traffic with a simple rule: iptables -I OUTPUT -p tcp --dport 25 -j DROP You could extend this to only drop packets sent by the www-data user which will be the user running the websites: iptables -I OUTPUT -p tcp --dport 25 -m owner --uid-owner www-data -j DROP What will help with your main problem (the sites becoming ...


2

From your description, I'm translating your question to: how to setup postfix so IF postfix receive an email with recipient domain is example.net AND IP address ism't IP address of spam filtering THEN send the email to spam filtering service. The possible solution is using Postfix Per-Client/User/etc. Access Control a.k.a. Postfix restriction classes. ...


2

Most MTA software (including Microsoft Exchange) will allow you to forge the From header in an email message. Also, SMTP itself is a protocol, like HTTP, so it would not be able to prevent it. Email spoofing is certainly nothing groundbreaking or new - I'd highly recommend the Wikipedia article on Email spoofing for more detail. Forging the From header is ...


1

It might be because Gmail is super strict about their mail policies. You should add a SPF record, something like v=spf1 ip4:ipofdomain include:_spf.google.com ~all Also Gmail works with dkim You should set this up. And also check if your blacklisted


1

If you can not access to your AD from outside, you can configure the user authentication with IMAP or SMTP The clustering of MailCleaner will not help you in this situation, it is just for load balancing and redundancy


2

Exchange isn't ignoring your setting. This happens because Connection filtering occurs before Content filtering. you'll need to add the sender's ip address to the IP Allow list. https://technet.microsoft.com/en-us/library/aa997242(EXCHG.80,printer).aspx


1

Yahoo now provides an SPF record: $ host -t txt yahoo.com yahoo.com descriptive text "v=spf1 redirect=_spf.mail.yahoo.com" Details on their policy here.


1

If you need something that will be inspecting the content of the HTTP requests and making inferences from that, deciding whether to block the request or not (perhaps based on requests over a period of time), then yes you need something other than AWS Security Groups. The Security Groups are effectively just iptables-type firewall rules, looking at ...


6

I kind of see where you're going with this. Let me add my two cents: Do I need to add an MX record to my internal DNS? No. That doesn't have any bearing on external to internal or internal to external email delivery. Do I need ask my ISP if they're able to change their PTR to mail.domain.org? That would be recommended so that when ...


3

Usually this line is enough: domain.com. IN TXT "v=spf1 mx a ~all" ^1 ^2 It allows all servers listed as an MX for domain.com to send emails for this domain. It allows the server with the IP of domain.com to send emails for this domain. So … No No, but it would be good. No, to all. Change it. No, internal hostnames and ip ...


1

See also How to block IP addresses from port 25 Spambots are generally poorly configured. In particular rDNS validation fails. Most (unfortuneately not all) legitimate servers have rDSN correctly configured. This allows you to make life difficult for spambots by delaying responses for poorly configured servers. Exim allows you to do this fairly easily. ...


0

You don't specify your mail software but there are a number of options for this case. They can be combined. (I would recommend the first for all hosts not providing MX services. It should resolve your issue.) Configure the mail server to listen on the local host interface(s) (127.0.0.0, ::1) only. Configure the mail server to use a common server as a ...


1

What McAfee told you is definitely the recommended approach here. Spammers intentionally try direct connections for the exact reason you pointed out - they're trying to bypass perimeter defenses. The specifics depend on your environment, preferences, and details from McAfee. Here are some links to get you started: ...


-1

Maybe an option to this case is put a conditional in the header field: /^(From|To):.*name[0-9]+@.*/ REJECT


0

Sorry for the mess. The problem was in other configurations of my main.cf file. It would have much easier for you guys if had posted that part. Still thank you all of you guys. The value for smtpd_sasl_local_domain = was not set. Hence the postfix was not using the smtp authentication. The new values are smtpd_sasl_local_domain = $mydomain ...


-1

There are a number of possibilities depending on your setup. The most likely is if your network is infected and sending out spam email as part of a botnet then that issue has to be dealt with first. Otherwise you will be continually added to blacklists. You need to check all machines on the network for viruses. The second possibility, although you haven't ...


-1

At our organization, we use a web application firewall (the Application Security Module [ASM] from F5) to block these kinds of requests. It works by first learning a database of acceptable URLs. It is intelligent enough to figure out all of the static links as well links which may be variable. For example, if a token or unique ID is included with a request, ...


1

There are some advantages to blocking such requests at the firewall level, namely: IPTABLES takes less resources to block the connection than Apache does to return an error. It will keep your log files smaller and cleaner. You mentioned blocking the hosts in httpd.conf. This is not as useful.. The bots are receiving a 404 anyway, it doesn't benefit you ...



Top 50 recent answers are included