Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 7362 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Reject Mails where mail from domain is receipient domain

Ulrich C. Thiess

Is it possible to mark e-mail domains as internal? Many spammers use the recipient domain as the sender domain. Such e-mails can still be rejected during transmission.



This thread was automatically locked due to age.
Parents
  • +1

    Ulrich,

    can you explain what you are trying to achieve? in order to make sure that email are only sent from the correct owner (so the server) you should use:

    • Proper RDNS record
    • SPF record
    • DKIM record

    Once you have configured them and your receiver uses strict email control (by checking those records) spoofing is prevented.

  • 0 in reply to lferrara

    Today I received a bounce message, which I could not get because of SPF.

     

    Your Email contains a virus infected file(s).
    ----------------------
    To: 
    Sent on: 2016-11-01 12:16:51
     
    Device found the following malware in the message:
    Troj/JSDwnldr-W,Mal/DrodZp-A
    ----------------------
     
    MESSAGE   Nov 01 12:16:49 [0x200017d3]: New SMTP Session Initialized 37.231.253.49:44486 ==> 192.168.178.2:25
    MESSAGE   Nov 01 12:16:51 [0x200017d5]: [0xc0000b86](info@msp-it.de)SF Policy Action: DROP
    ERROR     Nov 01 12:16:51 [3875953472]: insert_reason_for_action: REASON : Mail has been dropped by policy mail.msp-it.com Weiterleitung.
    MESSAGE   Nov 01 12:16:51 [3875953472]: Notification generated for AV incident: Recipient info@msp-it.de
    ERROR     Nov 01 12:16:51 [3875953472]: decide_departure_point: host count = 1
    MESSAGE   Nov 01 12:16:51 [0x200017d6]: Mail Transaction Started from 127.0.0.1:25 to 80.72.136.141:25 (fdid:26)
    MESSAGE   Nov 01 12:16:52 [0x200017d6]: [0x200017d60] Mail Received with 250 2.6.0 <f014aead-7968-4beb-a2b1-3d7a9f65fbc2@MAIL.msp-it.lan> [InternalId=2215] Queued mail for delivery
    ERROR     Nov 01 12:16:52 [3875953472]: insert_reason_for_action: REASON : Mail sent successfully.
    SPF Drop has been detected. The e-mail has not been canceled. Why is that?

    I think, if SPF -ALL specifies, then the e-mail should be canceled. (dig msp-it.de txt)

    If the transmission is aborted and it is an error, the sender receives a fault message. The error can only be found in the SPF record.
Reply Children