Spoofed From Field
Hello, i am having issues with spoofed from fields.
Now i know that there isn't much we can do technically. I keep seeing, it's like someone mailing somebody and putting my return address on the envelope.
With that said:
I have enabled SPF, DKIM, Boxtrapper and Spam Assassin.
The biggest issues is i'm having is spoofed from addresses emailed to myself. e.g:
random@randomspamwebsite.com with from field administrator@mydomain.com emails me@mydomain.com.
Administrator@mydomain.com doesn't exist, but my boxtrapper and filters see the from address and think it is a local address and deliver it to me.
From twrq@blinc.com Fri May 08 11:03:09 2015
Received: from p5ddddfb0.dip0.t-ipconnect.de ([93.221.223.176]:52286)
by weh.myhostname.com with esmtp (Exim 4.85)
(envelope-from )
id 1Yqjnv-0007ZN-IW; Fri, 08 May 2015 11:03:09 -0400
Received: from 3333.mydomain.ca (10.44.165.146) by mydomain.ca (10.0.0.193) with Microsoft SMTP Server id 5BQ9H3DN; Thu, 24 Jul 2014 09:38:30 GMT
Date: Thu, 24 Jul 2014 09:31:35 GMT
From: "Administrator@jamorim"
Message-ID: <20231938971938003612526211233155145886@mydomain.ca>
To: jamorim@mydomain.ca
Subject: Administrator - Exchange Email id8540894
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Next_78908_6010384905.4045458457934"
X-Spam-Status: No, score=1.1
X-Spam-Score: 11
X-Spam-Bar: +
X-Ham-Report: Spam detection software, running on the system "weh.myhostname.com",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: jamorim, This attachment(Exchange_id8540894.zip) provides
you with managing facilities for your mailboxes, public folders, distribution
lists, contact and mail service general settings. Please save the attached
file to your hard drive before deleting this message. [...]
Content analysis details: (1.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or
Generic rPTR
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
[93.221.223.176 listed in bl.score.senderscore.com]
1.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[93.221.223.176 listed in bb.barracudacentral.org]
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0020]
X-Spam-Flag: NO
X-BoxTrapper-Match: white: 153: administrator@mydomain.ca
------=_Next_78908_6010384905.4045458457934
Content-Type: text/plain;
Content-Transfer-Encoding: 8bit
SpamAssassin isn't pick this up even though it has a zipped .exe attached. My local virus scanner on my pc picks this up. I use boxtrapper to block all emails unless whitelisted, they are getting by with the from address which boxtrapper thinks is a local account. I have changed emails and cpanel passwords.
SpamAssassin isn't pick this up even though it has a zipped .exe attached. My local virus scanner on my pc picks this up. I use boxtrapper to block all emails unless whitelisted, they are getting by with the from address which boxtrapper thinks is a local account. I have changed emails and cpanel passwords.
-
I have enabled SPF, DKIM, Boxtrapper and Spam Assassin.
Hello, Have you enabled SPF and DKIM verification in the Exim Configuration Manager in WHM, or have you enabled SPF/DKIM records in your domain name's DNS zone? Thank you.0 -
Hello, Have you enabled SPF and DKIM verification in the Exim Configuration Manager in WHM, or have you enabled SPF/DKIM records in your domain name's DNS zone? Thank you.
Via Cpanel > Authentication v=spf1 +a +mx +ip4:SERVERIP +ip4:OFFICEIP -all exim i have reject spf failures on Allow DKIM verification for incoming messages = off which wont let me turn on reject dkim failures.0 -
Allow DKIM verification for incoming messages = off which wont let me turn on reject dkim failures.
You may want to consider enabling "Allow DKIM verification for incoming messages" so you can then reject DKIM failures. Thank you.0 -
You may want to consider enabling "Allow DKIM verification for incoming messages" so you can then reject DKIM failures. Thank you.
I just did this too. Hopefully that helps. Could i consider lowering my spam score to something like 1. Since boxtrapper should catch them anyways. Im still not quite sure why the boxtrapper is letting them through even though it isn't on the white list is this simply because it things the from domain is local?0 -
Could i consider lowering my spam score to something like 1. Since boxtrapper should catch them anyways. Im still not quite sure why the boxtrapper is letting them through even though it isn't on the white list is this simply because it things the from domain is local?
You can review the specific message in /var/log/exim_mainlog to determine how it's processed. EX:exigrep MSGID /var/log/exim_mainlog
Also, you should review the message header to see what the score is before lowering the SPAM score requirements. Thank you.0
Please sign in to leave a comment.
Comments
5 comments