Let me explain you the situation a bit..

There are two websites hosted in the same server, example1.com and example2.com. Suppose Example2 is hacked and the attacker writes a PHP function to send email using PHP mail function or sendmail and he is sending email with @example1.com domain addresses. SPF and DKIM records would identify outgoing mails from example2.com's script as legitimate because the SPF record points to the right server address, right?

Then.. Is it possible to stop a website hosted in your own private server sending emails (via PHP mail or sendmail) with other hosted domain's name ?

  • 1
    This depends on your MTA. In general, local processes are considered privileged and are not otherwise authenticated. Note that the usual sendmail program does not have mechanisms for user authentication save that they have write permissions to the mail queue. – Andrew Domaszek Mar 27 '17 at 20:47
  • The server uses postfix to send SMTP mail, but php mail functions are also available. I am thinking that the only solution would be to disallow sendmail or php scripts to send mail and configure the applications to send STMP authenticated emails. What do you think? – spacebiker Mar 28 '17 at 7:46

There are various options that can be used depending on the MTA. I am most familiar with Exim4 which allows for a number of options:

  • Require authentication for all mail originated using the web server's userid.
  • Prevent outgoing messages that arrive on unauthenticated IP connections. You may want to allow message forwarding.
  • Rate limit outgoing messages. This can be based on multiple factors.

The above does not deal with the fact that the script could just look up the MX for the destination and bypass your mail server. This would be missing the DKIM signature, but DKIM is frequently/usually not configured correctly. As a result, I am a long way from using DKIM for email validation. DMARC helps for those domains that publish a policy but is not widely deployed.

On Linux you can prevent the mail server being bypass with a firewall rule. It is possible to filter traffic based on user, so that only the mail server userid is allowed to send traffic on port 25. You may want to permit traffic on port 587 as that should require authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.