I run a mail server which appears to correctly handle emails with SPF set - however I've started receiving fake emails purporting to be from a bank - with the From address set as the bank - but which definitely do not originate from the bank.
The relevant headers of the email are as follows:
Delivered-To: email@example.com Received: from mail.mydomain.org (localhost [127.0.0.1]) by mail.mydomain.org (Postfix) with ESMTP id AD4BB80D87 for <firstname.lastname@example.org>; Thu, 13 Oct 2016 20:04:01 +1300 (NZDT) Received-SPF: none (www.tchile.com: No applicable sender policy available) receiver=mydomain.org; identity=mailfrom; envelope-from="email@example.com"; helo=www.tchile.com; client-ip=184.108.40.206 Received: from www.tchile.com (www.tchile.com [220.127.116.11]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.mydomain.org (Postfix) with ESMTPS id 40F6080B9F for <firstname.lastname@example.org>; Thu, 13 Oct 2016 20:03:57 +1300 (NZDT) Received: from www.tchile.com (localhost.localdomain [127.0.0.1]) by www.tchile.com (8.13.1/8.13.1) with ESMTP id u9D73sOG017283 for <email@example.com>; Thu, 13 Oct 2016 04:03:55 -0300 Received: (from apache@localhost) by www.tchile.com (8.13.1/8.13.1/Submit) id u9D73smu017280; Thu, 13 Oct 2016 04:03:54 -0300 Date: Thu, 13 Oct 2016 04:03:54 -0300 Message-Id: <201610130703.u9D73smu017280@www.tchile.com> To: firstname.lastname@example.org Subject: CANCELLATION_PROCESS. From: KIWI BANK <email@example.com> Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=029F3E3270D5187AA69203962BF830E3 X-Virus-Scanned: ClamAV using ClamSMTP
The key thing here is that kiwibank.co.nz is a legitimate, reputable bank where I am from, and have an SPF record which reads:
kiwibank.co.nz. 13594 IN TXT "v=spf1 include:_spf.jadeworld.com ip4:18.104.22.168 ip4:22.214.171.124 ip4:126.96.36.199 ip4:188.8.131.52 ip4:184.108.40.206 include:spf.smtp2go.com include:spf.protection.outlook.com -all"
So, after some reading - it appears that the Envolope-From is correct, but the "From" has been faked. Is there any way I can correct/mitigate this without breaking "general" email ? I note that I use Postfix, Spamassassin and policyd (postfix-policyd-spf-perl) - and if its really so easy to bypass, whats the point of SPF?