1

First of all : I know this subject is already treated in a few other topics. Unfortunally, nothing I could have read seems to work, so I'm looking for a new way of doing this.

I'm receiving a few times per day some spam mails which seems to come from my own domain (even more : from the e-mail address which is receiving the e-mails).

This is some informations :

Source of spam email (no-reply@calendridel.fr is my email address, vaeserveur.fr is the main server) :

Return-Path: <no-reply@calendridel.fr>
Delivered-To: no-reply@calendridel.fr
Received: from static.vnpt.vn (unknown [113.190.69.222])
    by vaeserveur.fr (Postfix) with ESMTP id 945F82880099
    for <no-reply@calendridel.fr>; Tue, 10 Apr 2018 12:56:11 +0200 (CEST)
Authentication-Results: vaeserveur.fr; dkim=none reason="no signature";
    dkim-adsp=discard (insecure policy); dkim-atps=neutral
Message-ID: <CE6EC615C066BD13B31BC81DBB60CE6E@RS6IKWLC1Q>
From: <no-reply@calendridel.fr>
To: <no-reply@calendridel.fr>
Subject: Olenka29
Date: 10 Apr 2018 23:33:06 +0600
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0020_01D3D0F5.0276B9FD"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 15.4.3508.1109
X-MimeOLE: Produced By Microsoft MimeOLE V15.4.3508.1109

This is what happens on logs for this e-mail :

Apr 10 12:56:10 vaeserveur postfix/smtpd[21347]: warning: hostname static.vnpt.vn does not resolve to address 113.190.69.222
Apr 10 12:56:10 vaeserveur postfix/smtpd[21347]: connect from unknown[113.190.69.222]
Apr 10 12:56:11 vaeserveur postfix/smtpd[21347]: 945F82880099: client=unknown[113.190.69.222]
Apr 10 12:56:12 vaeserveur postfix/cleanup[21354]: 945F82880099: message-id=<CE6EC615C066BD13B31BC81DBB60CE6E@RS6IKWLC1Q>
Apr 10 12:56:12 vaeserveur opendkim[29715]: 945F82880099: [113.190.69.222] [113.190.69.222] not internal
Apr 10 12:56:12 vaeserveur opendkim[29715]: 945F82880099: not authenticated
Apr 10 12:56:12 vaeserveur postfix/qmgr[17806]: 945F82880099: from=<no-reply@calendridel.fr>, size=1360, nrcpt=1 (queue active)
Apr 10 12:56:12 vaeserveur dovecot: lda(no-reply@calendridel.fr): msgid=<CE6EC615C066BD13B31BC81DBB60CE6E@RS6IKWLC1Q>: saved mail to INBOX
Apr 10 12:56:12 vaeserveur postfix/pipe[21356]: 945F82880099: to=<no-reply@calendridel.fr>, relay=dovecot, delay=1.1, delays=1/0/0/0.11, dsn=2.0.0, status=sent (delivered via dovecot service)
Apr 10 12:56:12 vaeserveur postfix/qmgr[17806]: 945F82880099: removed
Apr 10 12:56:12 vaeserveur postfix/smtpd[21347]: disconnect from unknown[113.190.69.222]

After the first e-mails received, I edited my DNS to make SPF and DKIM "stricts" as I could have seen in other topics (example with calendridel.fr but the same thing is done with vaeserveur.fr / i have my ip4 in the "a" record) :

calendridel.fr.                 IN TXT "v=spf1 a mx ip6:2001:41d0:1:e7c2::1 -all"
_domainkey.calendridel.fr.      IN TXT "t=y; o=-;"
mail._domainkey.calendridel.fr. IN TXT ("v=DKIM1; k=rsa;" "[mykey]")
_adsp._domainkey.calendridel.fr. IN TXT "dkim=discardable"
_dmarc.calendridel.fr.          IN TXT ("v=DMARC1;p=none;adkim=r;aspf=r;sp=none;rua=mailto:contact@calendridel.fr;ruf=mailto:contact@calendridel.fr;")

Those changes were inefficient, so I edited postfix too : I added those line to postfix/main.cf:

#Helo Restrictions
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname

#Sender Restrictions
smtpd_sender_restrictions = permit_mynetworks, reject_unknown_sender_domain, reject_non_fqdn_sender, reject_unlisted_sender, permit_sasl_authenticated, check_sender_access hash:/etc/postfix/access/sender_access

#Recipient Restrictions
smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unlisted_recipient, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

In the postfix/access/sender_access file, I tried to add calendridel.fr as a domain to reject (btw, doing so, is it supposed to block every email from the domain ? Meaning i wouldn't be able to send a e-mail from it myself ?) :

#Address            #Action
calendridel.fr      REJECT

This last change is recent (just after the last e-mail i received), but I guess it won't be enough.

If you have any clue, if you need more informations : let me know, I will give you with pleasure. (And sorry if my english is bad, as you can see I'm a frog... i mean, french !)

1

The check_sender_access solution is correct and well suitable. Because it's a hash:, remember to postmap /etc/postfix/access/sender_access after any changes.

You are mistaken that this will reject all mail from this domain; only if it's used from an unauthorized origin. That's because you have two crucial tests before your check_sender_access:

  • permit_mynetworks for any IP addresses matching your $mynetworks and
  • permit_sasl_authenticated for permitting requests for (RFC 4954) authenticated users.

Sender Policy Framework (SPF) would do the same and work even if you can't trust all the outgoing servers to be in $mynetworks or if they are hard to list as IP addresses (e.g. include:spf.protection.outlook.com). Your domain seems to have an SPF record already:

calendridel.fr. IN TXT "v=spf1 a mx ip6:2001:41d0:1:e7c2::1 -all"

Currently you don't utilize this for your incoming mail. See How To Implement SPF In Postfix.

Remember, that all this only works if your domain is used for the envelope sender address. It's still possible to spoof the From: header to be anything. E.g. Spamassassin can handle such cases. However, the envelope sender and From: header mismatch isn't generally wrong. If any external service isn't used to send email on behalf of your domain, then you could create a rule for that. Luckily, most of the spam would get enough score for other reasons even without such a rule.

  • Yep, I did postmap it after any changes. Thx for the explanation about check_sender_access, I wasn't sure (but I was able to send e-mails since the change was made.. ^^ ). I hope those actions will be enough, otherwise I'll try to create a rule as you said. Quick question, and I hope the answer is "yes" : am I the only one to receive those messages from my domain ? Meaning : nobody else is receiving those messages from "me", right ? ^^ Anyway, thx for your answer. – Vae Apr 10 '18 at 12:57
  • Someone could receive spoofed mail having your domain in the From: header, but your current SPF record should prevent using it as an envelope sender. Frankly, every decent email service provider today performs checks against SPF. A domain having such record isn't as favorable for spammers than one without. – Esa Jokinen Apr 10 '18 at 13:07
  • So I was waiting a few hours to see if the last change was efficient. Turns out it is not :( . I receive a new e-mail... If I understand it well, if I configure postfix to use SPF for incoming mail, it will just filter the e-mails i am receiving, right ? It's good for me, but what about those guys using my domain to send e-mails ? How is it possible with the configuration I made ? It's a lot of questions ^^ – Vae Apr 11 '18 at 3:48
  • You were talking about "creating a rule", would you have some explanations/a link about how to do it ? Thanks a lot for your concern. – Vae Apr 11 '18 at 13:00
  • 1
    FYI, i didn't receive anything for the past 2 days... I'm gonna cross fingers :) – Vae Apr 13 '18 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.