Re: [AMaViS-user] falsification of mail account

[Rob M. <rob...@gm...>]

On Fri, Feb 27, 2009 at 20:43, troxlinux <xse...@gm...> wrote:
> hello list has some days of not being able to block mail that send
> with my account to myself, I have my mail server with
> postfix+amavisd-new-2.5.1-27+sasl, are they using my mail account or
> of other users to send me mail to my own account and also with that of
> other users, will there be some form of being able to block this?

SPF and DKIM can help, if you both publish and check at your external
mail server(s).

Mail headers reversed to show chronological order:

> Received: from alcoa.com.au (unknown [189.106.168.97])
>        by ns1.superdominio.org.ni (Postfix) with SMTP id A49D516100917
>        for <wa...@su...>; Fri, 27 Feb 2009 12:01:11 -0600 (CST)

Mail sent from 189.106.168.97 and received by ns1.superdominio.org.ni.

This is where it entered your mail server, this is the point at which
you should have rejected it.

> Received: from ns1.superdominio.org.ni ([127.0.0.1])
>        by localhost (ns1.superdominio.org.ni [127.0.0.1]) (amavisd-new, port 10024)
>        with LMTP id 3K6WLKeakwYC for <wa...@su...>;
>        Fri, 27 Feb 2009 12:01:13 -0600 (CST)

Internal processing by ns1.superdominio.org.ni

> X-DKIM: Sendmail DKIM Filter v2.5.5 ns1.superdominio.org.ni B5BAD16100AEC
> DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=superdominio.org.ni;
>        s=default; t=1235757685; bh=/JdwMpPAOar3veUORJ8SgAH6AZyJuFmozd/yQkt
>        emFs=; h=To:Subject:From:MIME-Version:Content-Type:Message-Id:Date;
>        b=tMT9nWHQE9pxJKjE3ifQ0jdIEwTAB8L+BHqHzmjwcD1TExyIe0qsc2augFZ6+BTDN
>        DEEZS0iFY+BbJJ8WM2TjcIRhfCYHU9nmDC28d2K6sb5e1DYetZq4AsE/r/+lauhPKxU
>        AWPfjytqLTXdMB6d948iSMyYRcDjYDUHjU/3iec=

DKIM signing the incoming email, apparently you're either not
publishing a policy, or not checking it ;)

> Received: from localhost (localhost [127.0.0.1])
>        by ns1.superdominio.org.ni (Postfix) with ESMTP id B5BAD16100AEC
>        for <wa...@su...>; Fri, 27 Feb 2009 12:01:25 -0600 (CST)

More internal processing.

I'd recommend you:

a) Publish a sender signing policy for DKIM and check it

b) Publish and check an SPF record

-- 
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche