How to prevent remote hosts from delivering mail to Postfix with spoofed From header?

Question

I have a host, let's call it foo.com, on which I'm running Postfix on Debian. Postfix is currently configured to do these things:

All mail with @foo.com as recipient is handled by this Postfix server. It forwards all such mail to my Gmail account. The firewall thus allows port 25.
All mail with another domain as recipient is rejected.
SPF records have been set up for the foo.com domain, saying that foo.com is the sole origin of all mail from @foo.com.
Applications running on foo.com can connect to localhost:25 to deliver mail, with something@foo.com as sender.

However I recently noticed that some spammers are able to send spam to me while passing the SPF checks. Upon further inspection, it looks like they connect to my Postfix server and then say

HELO bar.com
MAIL FROM:<info@foo.com>     <---- this!
RCPT TO:<info@foo.com>
DATA
From: "Buy Viagra" <info@foo.com>   <--- and this!
...

How do I prevent this? I only want applications running on localhost to be able to say MAIL FROM:<something@foo.com>. Here's my current config (main.cf): https://gist.github.com/1283647

The "MAIL FROM:" / Envelope sender is not the "header" "From:". The "MAIL FROM:" is easy to fix by only allowing only auth'd users to send from your domain(s), and using SPF. The header "From:" (which is what most spammers spoof these days) would need to be checked with header check later I believe. I am still looking for a good answer to this myself. — B. Shea, May 16 '19 at 15:47
https://serverfault.com/questions/948161/postfix-blocking-by-from-rather-than-sender — B. Shea, May 16 '19 at 16:03

score 5 · Accepted Answer · edited Jul 04 '12 at 20:26

5

You need the smtpd_sender_restrictions to be:

smtpd_sender_restrictions = permit_mynetworks, check_sender_access hash:/etc/postfix/notfromme

and in /etc/postfix/notfromme you put

foo.com REJECT

then postmap /etc/postfix/notfromme and reload postfix.

Done.

edited Jul 04 '12 at 20:26

Hongli Lai

2,112
4
22
27

answered Oct 13 '11 at 12:01

mailq

16,882
2
36
66

I did this, and restarted Postfix, but it doesn't work. Postfix still lets my example session pass. – Hongli Lai Oct 14 '11 at 07:01
@HongliLai But your are not trying to telnet from localhost?! This is allowed as you requested. – mailq Oct 14 '11 at 08:50
No, I'm telnetting remotely. – Hongli Lai Oct 17 '11 at 09:54
@HongliLai I can guarantee that this works. – mailq Oct 17 '11 at 11:02
It looks like specifying `specificuser@foo.com` in notfromme works, but `@foo.com` and even `*@foo.com` do not. – Hongli Lai Jul 04 '12 at 13:06
But `foo.com` does. I had to specify it as follows: `foo.comREJECT`. – Hongli Lai Jul 04 '12 at 13:13
Also, this guide was very helpful and told me how the check_sender_access file is supposed to work: http://wiki.centos.org/HowTos/postfix_restrictions – Hongli Lai Jul 04 '12 at 13:28
Note: This does not work with "From:", but with "Mail From:" only. --- Postfix docs: "Optional restrictions that the Postfix SMTP server applies in the context of a client MAIL FROM command." – B. Shea Jun 23 '21 at 18:26

Digweed · Answer 2 · 2022-01-27T17:38:29.683

if you keep the smtpd_delay_reject parameter set to the default of “yes”, then most of the restrictions can be rolled up into the recipient restrictions.

smtpd_helo_required = yes 
smtpd_recipient_restrictions = 
                                your_permits (mynetworks, sasl, etc)
                                check_helo_access hash:/etc/postfix/helo_checks

helo_checks file:

# HELO'ing as being in our own domain(s)?
grokshop.tv             REJECT You are not in grokshop.tv
brackin.net             REJECT You are not in brackin.net

# HELO'ing with our IP address?
198.58.109.26           REJECT You are not 198.58.109.26

# HELO'ing as "localhost?"
localhost               REJECT You are not me

Note: On my postfix smtp_delay_reject is set to "no" and it's work for me.

Reference Link: https://grokshop.tv/stop-spam-with-postfix-email-server/

joeqwerty · Answer 3 · 2011-10-13T12:47:58.957

0

Here's my take on it:

SPFv1 protects the envelope sender address (Return-Path), not the header sender address (From). In most cases (at least that I've seen) the header sender address (From) is spoofed (as foo.com) but that's not what SPFv1 is checking so therefore it passes.

edited Oct 13 '11 at 12:47

answered Oct 13 '11 at 11:56

joeqwerty

108,377
6
80
171

gac · Answer 4 · 2011-10-13T11:49:29.233

I think if you add:

smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks check_helo_access hash:/etc/postfix/helo_access,

to your main.cf, and:

foo.com REJECT

to /etc/postfix/helo_access, followed by "postmap helo_access" and restarting postfix, that should mean anyone identifying themselves as "@foo.com" will be rejected straight out, UNLESS the connection is from the localhost in which case it will be permitted (due to permit_mynetworks ranking higher than check_helo_access).

edit - actually, that probably wouldn't help in the case that someone identifies as "HELO randomhost.net" and then sends mail from @foo.com. What you need to implement is probably header_checks:

http://www.postfix.org/header_checks.5.html http://www.postfix.org/BUILTIN_FILTER_README.html#remote_only

Once you have header_checks configured for spotting @foo.com mails, you should be able to configure master.cf so that anything from localhost skips these checks, and only incoming mail from other systems is checked. Then when you receive an email from @foo.com from another Internet system, that should be discarded.

Unfortunately, it's quite common for spammers to send a random HELO, even when faking the server. — Tzarium, Oct 13 '11 at 11:45

How to prevent remote hosts from delivering mail to Postfix with spoofed From header?

4 Answers4