Tom, how are you doing?
You can add the following rules to your smtpd_check_rules to prevent this type of abuse:
If you notice the host does not have a valid reverse lookup or MX entry, this user is "claiming to be yahoo.com".
The first rule below allows you to deny all SMTP hosts that do not have a valid MX entry or reverse DNS lookup.
The second rule allows you to deny the mailfrom address, if the from address does not have a valid DNS entry or MX record the mail will not be delivered.
Note that smtpd_check_rules is templated so I recommend you create a custom template:
mkdir -p /etc/e-smith/templates-custom/var/spool/smtpd/etc/smtpd_check_rules
pico -w 10NotoSpammers
#Deny SMTP hosts that do not have a reverse lookup or MX entry.
#[allow|deny|noto]:SourceList:FromList:ToList[:XXX message for deny/noto]
deny:UNKNOWN EXCEPT 192.168.0.1,127.0.0.1,216.79.168.196,216.191.234.126,144.86.
1.215:ALL:ALL:550 Your SMTP server's IP of %I does not have a reverse lookup or
MX entry, as a result your message to %T was not delivered. Please contact your mail administrator and inform them of the problem.
deny:ALL:NS=UNKNOWN:ALL:550 Your MAIL FROM address of %F does not have a reverse lookup or MX entry, as a result your message to %T was not delivered. Please contact your mail administrator and inform them of the problem.
Be sure to adjust your EXCEPT ruling as needed.
Hope this helped,
Nathan
4 Replies
1325 Views