2

for 2 weeks now I keep receiving spam emails sent from my own address.

Here's an example :

Apr  2 10:15:13 hostname postfix/smtpd[28874]: warning: hostname 212.156.246.74.static.turktelekom.com.tr does not resolve to address 212.156.246.74
Apr  2 10:15:13 hostname postfix/smtpd[28874]: connect from unknown[212.156.246.74]
Apr  2 10:15:14 hostname postfix/smtpd[28874]: 750991E018: client=unknown[212.156.246.74]
Apr  2 10:15:16 hostname postfix/cleanup[28880]: 750991E018: message-id=<003d01d3ca72$01abe830$217c6793$@mydomain.tld>
Apr  2 10:15:17 hostname opendkim[14624]: 750991E018: [212.156.246.74] [212.156.246.74] not internal
Apr  2 10:15:17 hostname opendkim[14624]: 750991E018: not authenticated
Apr  2 10:15:17 hostname opendkim[14624]: 750991E018: no signature data
Apr  2 10:15:17 hostname postfix/qmgr[19733]: 750991E018: from=<me@mydomain.tld>, size=3207, nrcpt=1 (queue active)
Apr  2 10:15:17 hostname dovecot: lda(me@mydomain.tld): msgid=<003d01d3ca72$01abe830$217c6793$@mydomain.tld>: saved mail to INBOX
Apr  2 10:15:17 hostname postfix/pipe[28882]: 750991E018: to=<me@mydomain.tld>, relay=dovecot, delay=2.7, delays=2.7/0.01/0/0.05, dsn=2.0.0, status=sent (delivered via dovecot service)
Apr  2 10:15:17 hostname postfix/qmgr[19733]: 750991E018: removed
Apr  2 10:15:18 hostname postfix/smtpd[28874]: disconnect from unknown[212.156.246.74]

I have these restictions :

smtpd_helo_required = yes
smtpd_client_restrictions = reject_rbl_client all.spam-rbl.fr
smtpd_sender_restrictions = permit_mynetworks permit_sasl_authenticated
smtpd_recipient_restrictions =
    reject_unknown_recipient_domain
    reject_non_fqdn_recipient
    reject_unlisted_sender
    permit_mynetworks
    reject_authenticated_sender_login_mismatch
    permit_sasl_authenticated
    reject_unauth_destination
    reject_unauth_pipelining
    reject_non_fqdn_sender
    reject_unknown_sender_domain
    reject_invalid_hostname

what should I add more to block these emails ?

Is it safe to block mails coming from unknown hostnames ?

One more thing that I've seen : according to my inbox, the above email has been received today at 12:40 pm even though I received it at 10:15 am. Is it also possible to forge the received time in the email ?

Thanks for your answers !

2

As we can see, this message uses your address as the envelope sender:

postfix/qmgr[19733]: 750991E018: from=<me@example.com>, size=3207, nrcpt=1 (queue active)

This means you have methods for rejecting such messages right after MAIL FROM (or RCPT TO, as I do). Regarding the headers like From: and Date:, they can be spoofed and contain anything. Additional spam filters like Spamassassin can perform tests against these, but that's another story.

Your email client is showing the time and date provided by the Date: header rather than the time the server has actually received the mail. You can look at the Received headers to see the dates added by the servers the message has gone through, but the email client trusts the Date: header.


METHOD 1: Blacklisting the domain from external sources

The methods aren't in order: the first one is easy to add, but the second one is better in every way.

If this server is the only legitimate source for email from your domain example.com, you could simply block all messages using from the domain, unless from own networks or an authenticated user, using check_sender_access. I personally put everything in smtpd_recipient_restrictions to get more details in the logs before rejecting the connection. For main.cf:

smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    . . .
    check_sender_access hash:/etc/postfix/access/sender_access,
    . . .

The /etc/postfix/access/sender_access is a lookup table (remember to postmap) of white- and blacklisted MAIL FROM addresses, domains etc. For blacklisting mail from this domain, e.g.

example.com   550 YOU ARE NOT ME.

METHOD 2: Implementing SPF for your domain and testing sender SPF in Postfix

If you have other sources for mail, you can't use the previous method. Also, SPF is something you should really implement to prevent your domain to be used for sending spam. First you add a TXT record for your domain listing all the authorized senders. See SPF Introduction and Record Syntax.

After that, configure your Postfix to check for SPF (see How To Implement SPF In Postfix). E.g.

  • Install Perl with Mail::SPF and NetAddr::IP modules.
  • Install postfix-policyd-spf-perl

  • main.cf:

    smtpd_recipient_restrictions =
        . . .
        reject_unauth_destination,
        check_policy_service unix:private/policy-spf,
        . . .
    
  • master.cf:

    policy-spf  unix  -       n       n       -       -       spawn
        user=nobody argv=/usr/bin/policyd-spf
    
1

My environment already has an outward facing port (25) for incoming mail and an another port (587) for authenticated sending.

In main.cf I have:

smtpd_sender_restrictions = check_sender_access pcre:/etc/postfix/sender-access

(I use pcre so I can use regexes)

Then in my /etc/postfix/sender-access I have:

/@example.com$/ REJECT 554 You may not send as example.com without authenticating.

(Replacing example.com with your own domain.)

But then I needed to override my 587 to not do the filtering -- so I added -o smtpd_sender_restrictions= to clear it:

So, in master.cf I now have:

# Incoming
25                        inet  n       -       n       -       -       smtpd
    -o mynetworks_style=host
    -o mynetworks=10.0.0.0/8
    -o milter_macro_daemon_name=ORIGIN_EXTERNAL

# TLS + authenticated submissions
587                       inet  n       -       n       -       -       smtpd
  -o smtpd_sender_restrictions=
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,defer
  -o milter_macro_daemon_name=ORIGIN_AUTH

(I suppose I could have done the reverse and cleared it in main.cf and set it in master.cf.)

To test, use 587 to send email to someone in your domain, then telnet to port 25 and see if you can hand spoof one:

$ telnet smtp.example.com 25
Trying 1.2.3.4...
Connected to smtp.example.com.
Escape character is '^]'.
220 smtp.example.com ESMTP Postfix
helo example.com
250 example.com
mail from: me@example.com
250 2.1.0 Ok
rcpt to: me@example.com
554 5.7.1 <me@example.com>: Sender address rejected: 554 You may not send as example.com without authenticating.
0

That is pretty common spammer tactic. You can limit it by requiring all senders to be permit_mynetworks and permit_sasl_authenticated this is set via thesmtpd_sender_restrictions

Here is an example of the iRedMail project:

# HELO restriction
smtpd_helo_required = yes
smtpd_helo_restrictions =
permit_mynetworks
permit_sasl_authenticated
check_helo_access pcre:/etc/postfix/helo_access.pcre
reject_non_fqdn_helo_hostname
reject_unknown_helo_hostname

# Sender restrictions
smtpd_sender_restrictions =
reject_unknown_sender_domain
reject_non_fqdn_sender
reject_unlisted_sender
permit_mynetworks
permit_sasl_authenticated
check_sender_access pcre:/etc/postfix/sender_access.pcre

# Recipient restrictions
smtpd_recipient_restrictions =
reject_unknown_recipient_domain
reject_non_fqdn_recipient
reject_unlisted_recipient
check_policy_service inet:127.0.0.1:7777
permit_mynetworks
permit_sasl_authenticated
reject_unauth_destination

You should remove the check_policy stuff if you don't have a policy server running.

  • I already had the permit_mynetworks and permit_sasl_authenticated restrictions. I will add the other restriction and see if I still got some spams – Nael Apr 2 '18 at 12:46
  • You can test it using telnet - try to send an e-mail to yourself from yourself without being authorized first and from a network that is not listed in permit_mynetworks technet.microsoft.com/en-us/library/aa995718(v=exchg.65).aspx (skip step 5-7) – Daniel Apr 2 '18 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.