When sending mails via SMTP, the sender mail address appears at two different positions: in the SMTP-MAIL FROM
request, and in the From
mail header field. Some MUAs only show the value of the From
mail header field.
Prevent forged envelope MAIL FROM
addresses
For preventing users authenticated via SMTP from forging sender addresses, the option reject_authenticated_sender_login_mismatch
in /etc/postfix/main.cf
can be used. Then, smtpd_sender_login_maps
should be adapted as well:
smtpd_sender_restrictions =
...
reject_authenticated_sender_login_mismatch,
...
smtpd_sender_login_maps = pcre:/etc/postfix/maps/smtpd_sender_login_map.pcre
The contents of /etc/postfix/maps/smtpd_sender_login_map.pcre
should then be according to tarleb’s answer:
Use this regex if your users are local users, i.e. if the login name
is just the username, not a full mail address. Note that literal dots
have to be backslash escaped (\.
) to avoid interpretation of these dots
as regex wildcard:
/^([^@+]*)(\+[^@]*)?@example\.com$/ ${1}
If one doesn't care about subaddresses, this could be simplified to:
/^(.*)@example\.com/ ${1}
This is appropriate if you have virtual users who login with their
full mail address as their username. Local addresses won't work, though:
/^(.*)$/ ${1}
The above config assumes that postfix was compiled with support for PCRE. On Ubuntu/Debian, this requires the postfix-pcre
package to be installed.
The sendmail
command will still allow local users to choose an arbitrary from address when sending, which is problematic with hacked user accounts. The easiest solution to this problem is probably to restrict the usage of the sendmail command in Postfix’ main.cf
, e.g.:
authorized_submit_users = root
Prevent forged From
mail header addresses
Postfix does not seem to provide some easy solution to this by itself. However, it can be accomplished with a milter.
For Rspamd, you can create/extend the configuration file /etc/rspamd.local.lua
by the following code:
local logger = require 'rspamd_logger'
rspamd_config:register_symbol({
name = 'FROM_HEADER_MISMATCH',
callback = function(task)
local user = task:get_user()
if not user then
return 0
end
for index, smtp_sender in pairs(task:get_from(1)) do
if smtp_sender.addr ~= user then
logger.infox('invalid SMTP sender: %1', smtp_sender.addr)
return 1
end
end
for index, mime_sender in pairs(task:get_from(2)) do
if mime_sender.addr ~= user then
logger.infox('invalid MIME sender: %1', mime_sender.addr)
return 1
end
end
return 0
end,
score = 16,
description = 'sender address in at least one mail header ' ..
'differs from the sender address in the envelope'
})
This will mark mail with multiple from addresses as spam and cause rejection of the message by Postfix. It prevents forged From
headers only if the envelope headers cannot be forged (see first part of the answer).
Alternatively, the milter vrfydmn is also able to replace the address in the From
mail header by the SMTP MAIL FROM
address.