Topic: Obviously spoofed email getting through

[Elliott]

My users have been getting email to them with titles like "please update your user@domain.com mailbox" or "your mailbox has been deactivated" types.

Now I have a relatively small user base and have done a good job of making them know how to ferret these baddies out. But the thing that gets me about these latest ones is that the from address is a valid internal address but the Received: lines are all external SNMP servers.

I only have IMAPS turned on for external networks so unless I'm missing something does this mean they've successfully guessed a legit password?

-Elliott

[CharlieBrady]

My users have been getting email to them with titles like "please update your user@domain.com mailbox" or "your mailbox has been deactivated" types.

Now I have a relatively small user base and have done a good job of making them know how to ferret these baddies out. But the thing that gets me about these latest ones is that the from address is a valid internal address but the Received: lines are all external SNMP servers.

You mean SMTP, I'm sure.

I only have IMAPS turned on for external networks so unless I'm missing something does this mean they've successfully guessed a legit password?

No. Mail would have arrived via non-authenticated SMTP (just like any other mail to your local domains). You can check the logs and verify.

SME server doesn't block messages with From: address from a local domain. Many people send via external mail services (e.g. gmail) with From: address set to their "home" domain. So it is sometimes legitimate for messages to come from outside with a local domain From: address.

If you want to block such inbound messages, you'd need to make custom changes, or sponsor development of a new feature.

[mmccarn]

Many of the spam filtering tools included with SME server are disabled by default in order to keep new SME admins from getting complaints about missing emails.

If you haven't already done so, read through the Sonoracomm howto for configuring the spam filters on SME server.

At a minimum, I recommend enabling:
- DNSBL
- RHSBL
- Spamassassin bayesian autolearning

If you continue to have problems, configure the 'LearnAsSpam' tools (described in the Sonoracomm HowTo) to allow users to specify spam and ham for their own email.

Usually the type of bogus email you are describing should be picked up by the DNSBL plugin.