Mailing List Archive

Joey J skrev den 2022-07-21 22:58:
> Hello,
>
> Is there a way for me to block mail that claims its from a certain
> domain, based on my own valid ip address list?
>
> Example:
>
> myserver.com [1] - IP address 1.2.3.4
> If a messages comes in from any server other than 1.2.3.4 for domain
> myserver.com [1] reject it?
>
> I know SPF/DKIM/DMARC would also help here, but trying to almost make
> my own ACL.

in mta stage i just reject local domains as sender envelope, this is
safe since local domains must sasl auth, bingo no more problems of
spoffed senders

try keep ips out of it

need more help ?, then show sample logs from postfix

my own problem is to know my custommers asn numbers :)

only known asn numbers can sasl auth, there is too much insane servers
to lift that

Most of the users servers I'm referring to are on the other side of our
mail gateway, so we know where they are sending from (through our gateway)
but when the client's domain is used on an inbound message, we would be
able to simply reject, knowing it's not the users servers sending it.

I agree don't re-invent, but some clients have many providers that send
email on their behalf making it more complicated.

On Fri, Jul 22, 2022 at 10:08 AM Reindl Harald <h.reindl@thelounge.net>
wrote:

>
>
> Am 21.07.22 um 22:58 schrieb Joey J:
> > Hello,
> >
> > Is there a way for me to block mail that claims its from a certain
> > domain, based on my own valid ip address list?
> >
> > Example:
> >
> > myserver.com - IP address 1.2.3.4
> > If a messages comes in from any server other than 1.2.3.4 for domain
> > myserver.com reject it?
>
> SPF
>
> > I know SPF/DKIM/DMARC would also help here, but trying to almost make my
> > own ACL
>
> why reinvent the wheel?
>
> such lists go outdated over time and are only asking for touble
>


--
Thanks!
Joey

On 22.07.22 11:26, Joey J wrote:
>Most of the users servers I'm referring to are on the other side of our
>mail gateway, so we know where they are sending from (through our gateway)
>but when the client's domain is used on an inbound message, we would be
>able to simply reject, knowing it's not the users servers sending it.

this is quite different problem from what you described before.

You can require sending mail with your domeins' envelope from to use
authentication at your MTA level or from a trusted IP.

for postfix:
http://www.postfix.org/RESTRICTION_CLASS_README.html

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
A day without sunshine is like, night.