First of all : I know this subject is already treated in a few other topics. Unfortunally, nothing I could have read seems to work, so I'm looking for a new way of doing this.
I'm receiving a few times per day some spam mails which seems to come from my own domain (even more : from the e-mail address which is receiving the e-mails).
This is some informations :
Source of spam email (email@example.com is my email address, vaeserveur.fr is the main server) :
Return-Path: <firstname.lastname@example.org> Delivered-To: email@example.com Received: from static.vnpt.vn (unknown [22.214.171.124]) by vaeserveur.fr (Postfix) with ESMTP id 945F82880099 for <firstname.lastname@example.org>; Tue, 10 Apr 2018 12:56:11 +0200 (CEST) Authentication-Results: vaeserveur.fr; dkim=none reason="no signature"; dkim-adsp=discard (insecure policy); dkim-atps=neutral Message-ID: <CE6EC615C066BD13B31BC81DBB60CE6E@RS6IKWLC1Q> From: <email@example.com> To: <firstname.lastname@example.org> Subject: Olenka29 Date: 10 Apr 2018 23:33:06 +0600 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0020_01D3D0F5.0276B9FD" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Live Mail 15.4.3508.1109 X-MimeOLE: Produced By Microsoft MimeOLE V15.4.3508.1109
This is what happens on logs for this e-mail :
Apr 10 12:56:10 vaeserveur postfix/smtpd: warning: hostname static.vnpt.vn does not resolve to address 126.96.36.199 Apr 10 12:56:10 vaeserveur postfix/smtpd: connect from unknown[188.8.131.52] Apr 10 12:56:11 vaeserveur postfix/smtpd: 945F82880099: client=unknown[184.108.40.206] Apr 10 12:56:12 vaeserveur postfix/cleanup: 945F82880099: message-id=<CE6EC615C066BD13B31BC81DBB60CE6E@RS6IKWLC1Q> Apr 10 12:56:12 vaeserveur opendkim: 945F82880099: [220.127.116.11] [18.104.22.168] not internal Apr 10 12:56:12 vaeserveur opendkim: 945F82880099: not authenticated Apr 10 12:56:12 vaeserveur postfix/qmgr: 945F82880099: from=<email@example.com>, size=1360, nrcpt=1 (queue active) Apr 10 12:56:12 vaeserveur dovecot: lda(firstname.lastname@example.org): msgid=<CE6EC615C066BD13B31BC81DBB60CE6E@RS6IKWLC1Q>: saved mail to INBOX Apr 10 12:56:12 vaeserveur postfix/pipe: 945F82880099: to=<email@example.com>, relay=dovecot, delay=1.1, delays=1/0/0/0.11, dsn=2.0.0, status=sent (delivered via dovecot service) Apr 10 12:56:12 vaeserveur postfix/qmgr: 945F82880099: removed Apr 10 12:56:12 vaeserveur postfix/smtpd: disconnect from unknown[22.214.171.124]
After the first e-mails received, I edited my DNS to make SPF and DKIM "stricts" as I could have seen in other topics (example with calendridel.fr but the same thing is done with vaeserveur.fr / i have my ip4 in the "a" record) :
calendridel.fr. IN TXT "v=spf1 a mx ip6:2001:41d0:1:e7c2::1 -all" _domainkey.calendridel.fr. IN TXT "t=y; o=-;" mail._domainkey.calendridel.fr. IN TXT ("v=DKIM1; k=rsa;" "[mykey]") _adsp._domainkey.calendridel.fr. IN TXT "dkim=discardable" _dmarc.calendridel.fr. IN TXT ("v=DMARC1;p=none;adkim=r;aspf=r;sp=none;rua=mailto:firstname.lastname@example.org;ruf=mailto:email@example.com;")
Those changes were inefficient, so I edited postfix too : I added those line to
#Helo Restrictions smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname #Sender Restrictions smtpd_sender_restrictions = permit_mynetworks, reject_unknown_sender_domain, reject_non_fqdn_sender, reject_unlisted_sender, permit_sasl_authenticated, check_sender_access hash:/etc/postfix/access/sender_access #Recipient Restrictions smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unlisted_recipient, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
postfix/access/sender_access file, I tried to add calendridel.fr as a domain to reject (btw, doing so, is it supposed to block every email from the domain ? Meaning i wouldn't be able to send a e-mail from it myself ?) :
#Address #Action calendridel.fr REJECT
This last change is recent (just after the last e-mail i received), but I guess it won't be enough.
If you have any clue, if you need more informations : let me know, I will give you with pleasure. (And sorry if my english is bad, as you can see I'm a frog... i mean, french !)