3

I have a host, let's call it foo.com, on which I'm running Postfix on Debian. Postfix is currently configured to do these things:

  1. All mail with @foo.com as recipient is handled by this Postfix server. It forwards all such mail to my Gmail account. The firewall thus allows port 25.
  2. All mail with another domain as recipient is rejected.
  3. SPF records have been set up for the foo.com domain, saying that foo.com is the sole origin of all mail from @foo.com.
  4. Applications running on foo.com can connect to localhost:25 to deliver mail, with something@foo.com as sender.

However I recently noticed that some spammers are able to send spam to me while passing the SPF checks. Upon further inspection, it looks like they connect to my Postfix server and then say

HELO bar.com
MAIL FROM:<info@foo.com>     <---- this!
RCPT TO:<info@foo.com>
DATA
From: "Buy Viagra" <info@foo.com>   <--- and this!
...

How do I prevent this? I only want applications running on localhost to be able to say MAIL FROM:<something@foo.com>. Here's my current config (main.cf): https://gist.github.com/1283647

  • The "MAIL FROM:" / Envelope sender is not the "header" "From:". The "MAIL FROM:" is easy to fix by only allowing only auth'd users to send from your domain(s), and using SPF. The header "From:" (which is what most spammers spoof these days) would need to be checked with header check later I believe. I am still looking for a good answer to this myself. – bshea May 16 '19 at 15:47
  • serverfault.com/questions/948161/… – bshea May 16 '19 at 16:03
5

You need the smtpd_sender_restrictions to be:

smtpd_sender_restrictions = permit_mynetworks, check_sender_access hash:/etc/postfix/notfromme

and in /etc/postfix/notfromme you put

foo.com REJECT

then postmap /etc/postfix/notfromme and reload postfix.

Done.

| improve this answer | |
  • I did this, and restarted Postfix, but it doesn't work. Postfix still lets my example session pass. – Hongli Lai Oct 14 '11 at 7:01
  • @HongliLai But your are not trying to telnet from localhost?! This is allowed as you requested. – mailq Oct 14 '11 at 8:50
  • No, I'm telnetting remotely. – Hongli Lai Oct 17 '11 at 9:54
  • @HongliLai I can guarantee that this works. – mailq Oct 17 '11 at 11:02
  • It looks like specifying specificuser@foo.com in notfromme works, but @foo.com and even *@foo.com do not. – Hongli Lai Jul 4 '12 at 13:06
0

Here's my take on it:

SPFv1 protects the envelope sender address (Return-Path), not the header sender address (From). In most cases (at least that I've seen) the header sender address (From) is spoofed (as foo.com) but that's not what SPFv1 is checking so therefore it passes.

| improve this answer | |
-1

I think if you add:

smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks check_helo_access hash:/etc/postfix/helo_access,

to your main.cf, and:

foo.com REJECT

to /etc/postfix/helo_access, followed by "postmap helo_access" and restarting postfix, that should mean anyone identifying themselves as "@foo.com" will be rejected straight out, UNLESS the connection is from the localhost in which case it will be permitted (due to permit_mynetworks ranking higher than check_helo_access).

edit - actually, that probably wouldn't help in the case that someone identifies as "HELO randomhost.net" and then sends mail from @foo.com. What you need to implement is probably header_checks:

http://www.postfix.org/header_checks.5.html http://www.postfix.org/BUILTIN_FILTER_README.html#remote_only

Once you have header_checks configured for spotting @foo.com mails, you should be able to configure master.cf so that anything from localhost skips these checks, and only incoming mail from other systems is checked. Then when you receive an email from @foo.com from another Internet system, that should be discarded.

| improve this answer | |
  • Unfortunately, it's quite common for spammers to send a random HELO, even when faking the server. – Tzarium Oct 13 '11 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.