-1

I run a cPanel host for my web clients, It has exim set as it's mail server. I have many clients running CMS'(mostly old joomla 1.5 which is nolonger maintained for security) that keep getting hacked to send spam from fictitious email accounts based on the domain they are hacked from. I only have a few specific email address that actually need to send anything. Is there a way I can configure exim (or is there an easier option to switch to) so that my server can Only send FROM specific whitelisted addresses? They are sent from php mail.

2
  • 3
    You're solving the wrong problem.
    – EEAA
    May 3, 2013 at 21:01
  • @EEAA long term I have to solve the other issues, but the sites cant just be disabled until I can fix all the other issues. Neither my clients or I are able to upgrade right now. We need to get this spam issue fixed right now so we can continue using the site. The other stuff will be fixed when my client is ready to upgrade, and I am available to do it. Already in discussions but, I can't do everybody all at once and we can't have them down until I can. right now I've had to disable sending email, which is crippling the sites and losing customers for them.
    – wmbf86
    May 3, 2013 at 21:16

1 Answer 1

1

Any reasonably useful hacker would quickly discover what addresses were whitelisted and spam anyway. This kind of thing affects your mail deliverability in the long term.

If your sites are getting hacked constantly and you know about it, you need to address the root cause, and patch. Usually, in your position, if your clients keep getting hacked and refuse to patch, you drop them to avoid being depeered or other reputational issues from the spam and attacks.

Keep in mind that the from: header is just a header. It has very little intrinsic meaning to SMTP. Therefore, you can just create a filter file like any other. There is a whole section on that in the documentation. You should specifically match on the $h_from: variable and apply the command seen finish to end processing.

Not the answer you're looking for? Browse other questions tagged .