Catch a forged Return Path

Hi all, new MS Azure Cloudapp Spam Wave these days. Just a few hosts, but a lot of Spam. There is a pattern there, they all use Return-Path: to disguise as a bounce and bypass any further checks. So the PCRE header check /^Return-Path: / REJECT Forged Return-Path does not catch. Any other

Re: Catch a forged Return Path

On 04.02.21 09:08, ludic...@gmail.com wrote: Just a few hosts, but a lot of Spam. There is a pattern there, they all use Return-Path: to disguise as a bounce and bypass any further checks. So the PCRE header check /^Return-Path: / REJECT Forged Return-Path does not catch. are you sure i

AW: Catch a forged Return Path

Hi, >>Return-Path: >> >>to disguise as a bounce and bypass any further checks. >> >>So the PCRE header check >> >>/^Return-Path: / REJECT Forged Return-Path >> >>does not catch. >are you sure it's a Return-Path header? >usually, envelope sender is put to Return-Path, so you may need to b

Re: Catch a forged Return Path

So the PCRE header check /^Return-Path: / REJECT Forged Return-Path does not catch. are you sure it's a Return-Path header? usually, envelope sender is put to Return-Path, so you may need to block envelope sender MAILER-DAEMON. You can see Return-Path after delivery to mbox, but it's often

Change default reject message

Hey, i have an question about postfix reject message: Plan it to integrate an mail quota via dovecot. If the target mailbox is full, so my mailsystem answer with: Your message to was automatically discarded: The original mail goes to mym...@mydomain.com postfix adress rewriting mail b

virtual-mailbox-users confusion

I'm slightly confused on postfix and virtual users. I have a small site (virtual users and dovecot for delivery) that handles mail for several domains: example.com, example.de, example.fr. The "real" addresses are at example.fr, so I've done the following:     /etc/postfix/main.cf:         virtua

on not being spam - mostly about DKIM and DMARC

I've a couple security/spam questions for the more experienced. 1(a)  A while back Gary noted the very useful http://dkimvalidator.com/ .  It has the curious habit of simultaneously saying     Validating Signature     result = pass     Details: in the DKIM section and this sort of thing in the

Re: on not being spam - mostly about DKIM and DMARC

Dnia 4.02.2021 o godz. 15:44:20 Jeff Abrahamson pisze: > 0.1 DKIM_INVALID   DKIM or DK signature exists, but is not > valid > > Is this normal or a point for worry?  It did say "not spam". I have noticed that it is common for SpamAssassin to say DKIM_INVALID for perfectly correctly

Re: Change default reject message

rud...@padaru.de: > i have an question about postfix reject message: > > Plan it to integrate an mail quota via dovecot. If the target mailbox is > full, so my mailsystem answer with: > > Your message to was automatically discarded: That is NOT a Postfix reject message. If you don't want this,

Re: on not being spam - mostly about DKIM and DMARC

On 2021-02-04 15:54, Jaroslaw Rafa wrote: Dnia 4.02.2021 o godz. 15:44:20 Jeff Abrahamson pisze: 0.1 DKIM_INVALID   DKIM or DK signature exists, but is not valid Is this normal or a point for worry?  It did say "not spam". I have noticed that it is common for SpamAssassin to sa

Re: on not being spam - mostly about DKIM and DMARC

Hello, I don't think you're in the right forum for these questions, as they aren't really realted to postfix. 0.1 DKIM_INVALID   DKIM or DK signature exists, but is not valid Is this normal or a point for worry?  It did say "not spam". I'd assume you did not add a milter which

Re: on not being spam - mostly about DKIM and DMARC

On 2021-02-04 16:42, Dirk Stöcker wrote: But if you have DKIM_INVALID for valid messages then something is not working. your dkim signer do c=relaxed/simple; with gives spamassassin invalid as i understand you there is verifiers that says its valid ? that c= is imho default in opendkim, but

Re: on not being spam - mostly about DKIM and DMARC

On 4 Feb 2021, at 9:44, Jeff Abrahamson wrote: I've a couple security/spam questions for the more experienced. 1(a)  A while back Gary noted the very useful http://dkimvalidator.com/ .  It has the curious habit of simultaneously saying     Validating Signature     result = pass     Details:

Re: on not being spam - mostly about DKIM and DMARC

Correcting myself: On 4 Feb 2021, at 11:47, Bill Cole wrote: However it is so easy to break a DKIM signature, especially if the 'strict' canonicalization is specified, s/strict/simple/ The 'simple' canonicalizations for headers and body are strict in that they do very little to eliminate th

Re: virtual-mailbox-users confusion

On Thu, Feb 04, 2021 at 02:39:06PM +0100, Jeff Abrahamson wrote: > I have a small site (virtual users and dovecot for delivery) that > handles mail for several domains: example.com, example.de, example.fr. > The "real" addresses are at example.fr, so I've done the following: In that case the othe

Re: on not being spam - mostly about DKIM and DMARC

On Thu, 4 Feb 2021, Jeff Abrahamson wrote: 2(a)  I get lots of dmarc reports.  After looking at a few, I started pushing them to a special dmarc mailbox where I don't have to see them.  Is there any sense in which these are actionable ?  Should I occasionally look at them or set a machine to loo

Re: Catch a forged Return Path

On 2021-02-04 09:08, ludic...@gmail.com wrote: Hi all, new MS Azure Cloudapp Spam Wave these days. Just a few hosts, but a lot of Spam. There is a pattern there, they all use Return-Path: to disguise as a bounce and bypass any further checks. So the PCRE header check /^Return-Path: /