0

I am receiving spam mail from a spoofed email account in my debian postfix server. SPF checks are activated, but the messages still arrives. The SPF checker reports PASS as seen in the headers below, but on the email message the sender is one of the internal real email addresses ex:info@mydomain.com

This is an example header:

List-Unsubscribe: ⁨<https://vitzrosys.com/unsubscribe/fh/368377/f4yn62jna76ixxomgw35df60kjthgso7xutizuefpj47csn4pik8na5n8rqvxh8y/44660>⁩
Feedback-Id: ⁨43fyr6oy4dk2gyet1wr9xxm8x28wdnh14sptosb7oo6iy0k:none:qovak⁩
X-Wb-Res: ⁨-7:HEADER_CT_006,HEADER_MAILER_013 str=0001.0A150207.5CB3E138.004E,ss=1,pt=R_652295,fgs=0⁩
Abuse-Reports-To: ⁨abuse@mailer.vitzrosys.com⁩
Return-Path: ⁨<heeya0224@vitzrosys.com>⁩
Mime-Version: ⁨1.0⁩
X-Virus-Scanned: ⁨Debian amavisd-new at sd-****.mypostfixserver.net
X-Complaints-To: ⁨abuse@vitzrosys.com⁩
X-Priority: ⁨5 (Lowest)⁩
X-Aid: ⁨9665490041⁩
Errors-To: ⁨update+w34gagcfhpqygi3p02@vitzrosys.com⁩
⁨<ryepchn52569376.96730353@vitzrosys.com>⁩
X-Sender: ⁨heeya0224@vitzrosys.com⁩
Content-Type: ⁨multipart/related; boundary="099734859349400469-E8FD0309B02"⁩
Received-Spf: ⁨Pass (mailfrom) identity=mailfrom; client-ip=222.109.145.40; helo=mail.vitzro.com; envelope-from=heeya0224@vitzrosys.com; receiver=<UNKNOWN> ⁩
Delivered-To: ⁨info@mydomain.com
X-Csa-Complaints: ⁨whitelistcomplaints@vitzrosys.com⁩
Received: ⁨from localhost (localhost [127.0.0.1]) by sd-****.mypostfixserver.net (Postfix) with ESMTP id 8D8E9E1838E3 for <info@mydomain.com>; Mon, 15 Apr 2019 03:44:49 +0200 (CEST)⁩
Received: ⁨from sd-****.mypostfixserver.net ([127.0.0.1]) by localhost (sd-****.mypostfixserver.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EMQ9lXQzPWUU for <info@mydomain.com>; Mon, 15 Apr 2019 03:44:47 +0200 (CEST)⁩
Received: ⁨from mail.vitzro.com (mail.vitzro.com [222.109.145.40]) by sd-****.mypostfixserver.net (Postfix) with ESMTP id 78B2CE1838D6 for <info@mydomain.com>; Mon, 15 Apr 2019 03:44:44 +0200 (CEST)⁩
Received: ⁨from [213-195-147-142.static.ip.netia.com.pl] ( [213.195.147.142]) by mail.vitzro.com (DEEPSoft WBlock.s(E).h 5.04.170) with ESMTP id <ryepchn52569376.96730353@vitzrosys.com> for <info@mydomain.com>; Mon, 15 Apr 2019 10:44:44 +0900⁩

I know that I cannot stop spammers spoofing my domains, but how can I stop it in my postfix server?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.