I have a ton of incoming spam that masquerades as being sent by me, but has a sender at some arbitrary spammer domain. e.g.
Return-Path: <firstname.lastname@example.org> ... (stuff elided, etc.) Received: from [static-18.104.22.168-ttvi.com.br] (unknown [22.214.171.124]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: email@example.com) by Server22.lejj.com (Postfix) with ESMTPSA id B527943151 ... To: firstname.lastname@example.org From: <email@example.com>
The sender to postfix is firstname.lastname@example.org, but by the time it's handed off to Cyrus-IMAP, it appears to be sent by me, and that means it's deposited into my recognized sender inbox.
I'd like to block all incoming mail from my domain (outgoing uses TLS + SMTP AUTH, and bypasses the checks, so I'm not worried about blocking myself), but since the sender address is not from my domain, I can't do that using sender rejection rules or SPF - these act on aiuw.com, not example.com.
I'm guessing there's no way to make Postfix handle the From line as part of the envelope information. Is that right, or am I missing something?
If not, what about a filter between Postfix and Cyrus-IMAP that could capture both the sender and From addresses and reject mismatches? Or, finally, a way of checking the sender address in a Sieve script, though I think that would get ugly quickly.
Apologies if this is a duplicate. I found several hits, but everything I saw was based on envelope sender, not From.