Re: Does postfix reject spoofed senders?

[Lorenzo Petracchi]

Il Venerdì 30/03/2018 08:05 Dominic Raferd ha scritto:

On 30 March 2018 at 06:51, Lorenzo Petracchi 
<lorenzo.petrac...@unifi.it> wrote:



Is there a reliable way to reject incoming mails with a spoofed e-mail
address?


Please clarify what you mean.


In the last few weeks our e-mail users are receiving many messages with 
their own address as From header.


I understand that there are many legitimate reasons why the From header 
is free but I would like to understand if it is possible and if it makes 
sense to reject incoming mail that contains addresses in the form 
al...@mydomain.it in the header field when the sender is not an our SASL 
authenticated SMTP sender or when they do but does not own that address.


   Lorenzo

Does postfix reject spoofed senders?

[Lorenzo Petracchi]

Is there a reliable way to reject incoming mails with a spoofed e-mail 
address?


Lorenzo

R: Header from rewrite

[Lorenzo Petracchi]

I think it is a good idea to prepend a sender: do you know if it is
possibile to prepend a default sender for any sasl user?

I tried smtpd_sender_login_maps and I put a map with addr...@mydomain.com
username: it works for mail from.


-Messaggio originale-
Da: owner-postfix-us...@postfix.org [mailto:owner-postfix-us...@postfix.org]
Per conto di Viktor Dukhovni
Inviato: sabato 12 agosto 2017 19:17
A: Postfix users <postfix-users@postfix.org>
Oggetto: Re: Header from rewrite 


> On Aug 12, 2017, at 1:05 PM, Lorenzo Petracchi
<lorenzo.petrac...@unifi.it> wrote:
> 
> Hello, does anybody know if there is a way to force the header (From:) to
be rewritten so that it is equal to envelope (MAIL FROM), just for outgoing
mail and sasl authenticated sender?

This would lose the associated display name, as Postfix has no way to
reconstruct that just from the MAIL FROM.
It might be better to prepend a "Sender:" header on port 587.  Some MUAs
will display "From:  on behalf of " (this is one
of the few actually nice features of Outlook from my perspective).

Otherwise, if you use header-checks to delete the "From:" header, a new one
will be added based on the envelope sender.  You can do this on port 587,
where all and only SASL authenticated users sending outbound email should be
seen.

-- 
-- 
Viktor.

Header from rewrite

[Lorenzo Petracchi]

Hello, does anybody know if there is a way to force the header (From:) to be 
rewritten so that it is equal to envelope (MAIL FROM), just for outgoing mail 
and sasl authenticated sender?