Re: spam from own email address

2019-04-25 Thread Wietse Venema
man 5 header_checks DUNNO Pretend that the input line did not match any pattern, and inspect the next input line. This action can be used to shorten the table search. For backwards compatibility reasons, Postfix also accepts OK but

Re: spam from own email address

2019-04-24 Thread Mick
On 25/04/2019 00:21, Wietse Venema wrote: Mick: I thought header checks were carried out after all the other smtp restrictions had passed therefore I didn't see the harm in an 'OK' for a message header at this stage. Correct, but the OK action applies only to that header, not the message. Tha

Re: spam from own email address

2019-04-24 Thread Wietse Venema
Mick: > I thought header checks were carried out after all the other smtp > restrictions had passed therefore I didn't see the harm in an 'OK' for a > message header at this stage. Correct, but the OK action applies only to that header, not the message. The Postfix 3.2 PASS action applies to th

Re: spam from own email address

2019-04-24 Thread Mick
On 24/04/2019 21:51, Bill Cole wrote: On 24 Apr 2019, at 16:04, Mick wrote: On 23/04/2019 18:34, Bill Cole wrote: On 23 Apr 2019, at 11:46, John Peach wrote: On 4/23/19 11:39 AM, Paul wrote: Yes I agree with Kevin here, the best solution to this problem is an spf record set to reject mail f

Re: spam from own email address

2019-04-24 Thread Bill Cole
On 24 Apr 2019, at 16:04, Mick wrote: On 23/04/2019 18:34, Bill Cole wrote: On 23 Apr 2019, at 11:46, John Peach wrote: On 4/23/19 11:39 AM, Paul wrote: Yes I agree with Kevin here, the best solution to this problem is an spf record set to reject mail from any ip that’s not in your allowed

Re: spam from own email address

2019-04-24 Thread Mick
On 23/04/2019 18:34, Bill Cole wrote: On 23 Apr 2019, at 11:46, John Peach wrote: On 4/23/19 11:39 AM, Paul wrote: Yes I agree with Kevin here, the best solution to this problem is an spf record set to reject mail from any ip that’s not in your allowed list of ips for your domain. Forging a f

Re: spam from own email address

2019-04-24 Thread Mick
On 23/04/2019 18:34, Bill Cole wrote: On 23 Apr 2019, at 11:46, John Peach wrote: On 4/23/19 11:39 AM, Paul wrote: Yes I agree with Kevin here, the best solution to this problem is an spf record set to reject mail from any ip that’s not in your allowed list of ips for your domain. Forging a f

Re: spam from own email address

2019-04-24 Thread Dominic Raferd
On Tue, 23 Apr 2019 at 18:35, Bill Cole < postfixlists-070...@billmail.scconsult.com> wrote: > On 23 Apr 2019, at 11:46, John Peach wrote: > > > On 4/23/19 11:39 AM, Paul wrote: > >> Yes I agree with Kevin here, the best solution to this problem is an > >> spf record set to reject mail from any ip

Re: spam from own email address

2019-04-23 Thread Bill Cole
On 23 Apr 2019, at 17:16, BlackIce_ wrote: I have had a significant backscatter issue in the past. lately I have been seeing the same issue you all are. I have Spamassassin and a postfix server setup and it works most of the time. Likely I need additional filter lines. I saw the KAM.cf menti

Re: spam from own email address

2019-04-23 Thread BlackIce_
I have had a significant backscatter issue in the past. lately I have been seeing the same issue you all are. I have Spamassassin and a postfix server setup and it works most of the time. Likely I need additional filter lines. I saw the KAM.cf mentioned, but do not see a place to obtain it. A

Re: spam from own email address

2019-04-23 Thread John Stoffel
> "Phil" == Phil Stracchino writes: Phil> On 4/23/19 2:40 PM, lists wrote: >> I would investigate using rspamd rather than spamassassin. At the moment >> I run neither since I have settled upon a nice mix of RBLs and check the >> reverse pointer. That Perl code to get rid of dynamic domains r

Re: spam from own email address

2019-04-23 Thread lists
, and false positives are an issue. I would just mark the email as spam when I ran spamassassin, so I ended up looking at the spam email anyway.   Original Message   From: ph...@caerllewys.net Sent: April 23, 2019 11:50 AM To: postfix-users@postfix.org Subject: Re: spam from own

Re: spam from own email address

2019-04-23 Thread Phil Stracchino
On 4/23/19 2:40 PM, lists wrote: > I would investigate using rspamd rather than spamassassin. At the moment > I run neither since I have settled upon a nice mix of RBLs and check the > reverse pointer. That Perl code to get rid of dynamic domains really > helps nuke spammers. > > Spamassassin tend

Re: spam from own email address

2019-04-23 Thread lists
.  From: pm...@iljones.netSent: April 23, 2019 9:11 AMTo: postfix-users@postfix.orgSubject: Re: spam from own email

Re: spam from own email address

2019-04-23 Thread Bill Cole
On 23 Apr 2019, at 11:46, John Peach wrote: On 4/23/19 11:39 AM, Paul wrote: Yes I agree with Kevin here, the best solution to this problem is an spf record set to reject mail from any ip that’s not in your allowed list of ips for your domain. Forging a from address is very easy and is one of

Re: spam from own email address

2019-04-23 Thread B. Reino
On Tue, 23 Apr 2019, Ian Jones wrote: I am getting emails like the one below, in which the header from is my own address. The emails contain text in a jpg image and claims my account has been hacked and demands $1000 paid to a bitcoin account. I would like to find a way to reject emails from m

Re: spam from own email address

2019-04-23 Thread Ralph Seichter
* John Peach: > It is not meant to catch the envelope sender. That should be in your > normal checks. Which is why I mentioned check_sender_access as an addition, for the OP's benefit. -Ralph

Re: spam from own email address

2019-04-23 Thread Kevin A. McGrail
On 4/23/2019 12:20 PM, Benny Pedersen wrote: > // maintainer hat on > > why are this rules not added to spamasassin core :( > Because masscheck and rule qa takes too long for the purposes we need the rules for. > \\ maintainer hat off > > or atleast a real spamassassin channel repo Time/money/en

Re: spam from own email address

2019-04-23 Thread Benny Pedersen
It is not meant to catch the envelope sender. That should be in your normal checks. This is specifically for the data From:, which is what these are using. this will reject maillist posttings of your own unless the maillists takes over From: header and claims maillists breaks spf and dkim /

Re: spam from own email address

2019-04-23 Thread Benny Pedersen
Kevin A. McGrail skrev den 2019-04-23 17:26: On 4/23/2019 10:02 AM, Ian Jones wrote: I am getting emails like the one below, in which the header from is my own address. Ian, are you using Apache SpamAssassin or something in the mix?  I've published a lot of rules for these sexploitation scams

Re: spam from own email address

2019-04-23 Thread Ian Jones
Thanks for all the suggestions: - I have an SPF record, but postfix not rejecting these, presumably because the enveloper sender is valid - I am not using SpamAssassin, but I'm coming round to the idea! - John: this idea seems simple and effective, I will give it a try. Many thanks, Ian Le

Re: spam from own email address

2019-04-23 Thread John Peach
On 4/23/19 11:54 AM, Ralph Seichter wrote: * John Peach: /^From:.*\@example\.com/ REJECT This header check will not catch the envelope sender, so I suggest adding "check_sender_access pcre:/path/to/sender_access" to the mix (file content according to your needs, of course). It is not meant

Re: spam from own email address

2019-04-23 Thread Ralph Seichter
* John Peach: > /^From:.*\@example\.com/ REJECT This header check will not catch the envelope sender, so I suggest adding "check_sender_access pcre:/path/to/sender_access" to the mix (file content according to your needs, of course). -Ralph

Re: spam from own email address

2019-04-23 Thread John Peach
On 4/23/19 11:39 AM, Paul wrote: Yes I agree with Kevin here, the best solution to this problem is an spf record set to reject mail from any ip that’s not in your allowed list of ips for your domain. Forging a from address is very easy and is one of the main purposes of why spf was created.

Re: spam from own email address

2019-04-23 Thread Wietse Venema
Paul: > Yes I agree with Kevin here, the best solution to this problem is > an spf record set to reject mail from any ip that?s not in your > allowed list of ips for your domain. Forging a from address is > very easy and is one of the main purposes of why spf was created. How does SPF block an add

Re: spam from own email address

2019-04-23 Thread Paul
Yes I agree with Kevin here, the best solution to this problem is an spf record set to reject mail from any ip that’s not in your allowed list of ips for your domain. Forging a from address is very easy and is one of the main purposes of why spf was created. Sent from my iPhone > On Apr 23, 2

Re: spam from own email address

2019-04-23 Thread Kevin A. McGrail
On 4/23/2019 10:02 AM, Ian Jones wrote: > I am getting emails like the one below, in which the header from is my > own address. Ian, are you using Apache SpamAssassin or something in the mix?  I've published a lot of rules for these sexploitation scams in KAM.cf and with an SPF record, you really

Re: spam from own email address

2019-04-23 Thread Wietse Venema
Ian Jones: > Hello, > > I am getting emails like the one below, in which the header from is my > own address. The emails contain text in a jpg image and claims my > account has been hacked and demands $1000 paid to a bitcoin account. I > would like to find a way to reject emails from my own add

Re: spam from own email address

2019-04-23 Thread Nick Howitt
On 23/04/2019 15:02, Ian Jones wrote: Hello, I am getting emails like the one below, in which the header from is my own address. The emails contain text in a jpg image and claims my account has been hacked and demands $1000 paid to a bitcoin account. I would like to find a way to reject email

spam from own email address

2019-04-23 Thread Ian Jones
Hello, I am getting emails like the one below, in which the header from is my own address. The emails contain text in a jpg image and claims my account has been hacked and demands $1000 paid to a bitcoin account. I would like to find a way to reject emails from my own addresses except from my