How To Block Email Spoofing by Display Name

Please try below tips. 

su - zimbra
vi /opt/zimbra/conf/from_checks


Fill with the following line

/^From:(.*@)+(.*@)/ HOLD it looks like you are spam

Note : If you receive email that having @ in the display name, email will be hold and you will getting information “it looks like you are spam” in the log. You can change HOLD with another method like DISCARD or REJECT.


Run the following command to add header check and restart postfix

zmprov ms `zmhostname` zimbraMtaHeaderChecks "pcre:/opt/zimbra/conf/postfix_header_checks,pcre:/opt/zimbra/conf/from_checks"
postfix reload


The following is an example email log that use @ in the display name

D6CAE2811C34: hold: header From: "imanudin@example.net" <spam@spam.xyz> from unknown[120.xxx.xxx.xx]; from=<spam@spam.xyz> to=<cilox@example.com> proto=ESMTP helo=: it looks like you are spam
Nov  1 23:45:45 myzimbra postfix/cleanup[17284]: D6CAE2811C34: message-id=<c8432028-4616-fcea-2280-699b7e22058e@spam.xyz>

Exmaple in mailq

[zimbra@myzimbra ~]$ mailq
-Queue ID-  --Size-- ----Arrival Time---- -Sender/Recipient-------
D6CAE2811C34!     626 Thu Nov  1 23:45:45  spam@spam.xyz
                                         cilox@imanudin.com

-- 1 Kbytes in 1 Requests.
In the Queue ID, have a ! sign (exclamation mark). It’s mean email holds. You can delete them (if that email is spam) or you can release them (if that email is not spam).

Comments

Popular posts from this blog

Disabling Zimbra's AntiSpam, Amavis and AntiVirus filtering

Cambium cnPilot E400/E410/E500 Configuration Tutorial

Error "Unable to retrive Zimbra GPG key for package validation"