blocking spoofed emails

[salik]

Hi,

i spent almost whole day looking for a solution I once had to block emails spoofed to be looking like sent from my email address to myself.

Anyone could help?
And yeah, I tried search. Nothing came out. I am probably blind by now.

Be grateful...
Regards,

Mike

 

[zEitEr]

Hello,

I guess you need to use SPF check.

 

[NoBaloney2]

Hi,

i spent almost whole day looking for a solution I once had to block emails spoofed to be looking like sent from my email address to myself.

Personally I think it's a bad idea. Why? Because from time to time you probably will get legitimate emails from your own address; for example, when I'm travelling and using squirrelmail I often bcc a copy to myself.

That said you can add some customization to do it into /etc/exim.pl.

Jeff

 

[salik]

es I do remember you gave the same answer some time ago, nevertheless you came up with solution I cannot find now which worked for me. Would it be difficult to set such a rule?

Regards,

Mike

 

[NoBaloney2]

The following is NOT recommended. It presumes all email from you to you is spoofed, under these conditions:

Depending on where you put it, it will accept such mail which comes in on port 587; that means everyone who's an authenticated sender on the server. But otherwise it may deny such messages even if they originate on the server. Which means if you want to get email which the server sends from your address (which it may do depending on your setup) you'll need to be careful to accept those emails before this deny.

Note also that it depends on the sender address which may or may not be the same as the From address, and the recipient address which may not be the same as the To address.

I'm not going to suggest where you should put it because frankly I don't think you should put it anywhere, but if you want to know in which section of the file it would go to be effective, it needs to be in the acl_check_recipient section.

WARNING: This code is NOT tested; it may break everything. Try it at your own risk. Or hire me (I wrote the default SpamBlocker exim.conf file used by DirectAdmin and the SpamBlocker-powered exim.conf file for DirectAdmin I give away here [nobaloney.net]) or someone else from these forums to create, test and install a solution for you.

#deny spoofed email from me
  deny message = Spoofed sender says it's me
    senders = [email protected]
    local parts = me
    domains = example.com

Jeff

 

[salik]

thank you

Jeff, thank you, I will test it and let you know how it went

Regards,

Mike

 

[NoBaloney2]

Note that if you want a more generic method; one you can use for many people, you can use either inline lists in exim.conf, or even file lists. It's beyond the scope of forum support to teach exim.conf file coding but there are examples of both in the current exim.conf file. In fact I used some lines already in my latest version of exim.conf as examples when I created the above code for you.

Jeff

 

[salik]

that would be interesting

Yes it works fine for me and I have been already trying to make more generic soultion but failed.

Can you point me to the part of exim.conf you mentioned?

Regards,

Mike

 

[NoBaloney2]

The sections of exim.conf that refer to the various blocklists, such as bad_sender_hosts, etc.

Jeff