On Mon, 20 Aug 2007, FaberK wrote: > Hi, > following your suggestions, I've noticed that those mails got as > > Return-Path: > > my address that is in whitelist.
It is trivially easy for an external mail client to forge the sender address to make the message appear as if it is coming from your domain. This is why using whitelist_from is a *last resort*. Remove your domain from whitelist_from. The first question to ask is, why do you feel you need to whitelist your own domain? If you want to bypass SA for locally-originated mail for some reason either: (1) Tell your MTA to not pass internally-originated email to SA in the first place (better), or (2) Use whitelist_from_rcvd to tell SA that mail from your domain name originates from your local network space only. Does that better clarify things? -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- So Microsoft's invented the ASCII equivalent to ugly ink spots that appear on your letter when your pen is malfunctioning. -- Greg Andrews, about Microsoft's way to encode apostrophes ----------------------------------------------------------------------- 5 days until The 1928th anniversary of the destruction of Pompeii
