how to reject domain not equal to sender address

[wilbourne]

Hello,

I would like to know, how I can reject some domain name who is not equal to "from mail address"?

I've check on postfix and mailscanner conf in smtp_recipient & data_restriction but it's seem not working and sometime mailscanner let happen spam.
the score seem not to be coherent

here is a screenshot
non store

good

2016-10-05 18_20_00-MailWatch for Mailscanner - Message Detail 61AA9100083.ADC94.png (36.91 KiB) Viewed 7260 times

store

not good

2016-10-05 18_15_49-MailWatch for Mailscanner - Message Detail 90AFB1007D5.A3F7A.png (45.44 KiB) Viewed 7260 times

[pdwalker]

Sorry, I don't fully understand what you are trying to do.

Can you explain what conditions you want to accept or reject the mail?

[wilbourne]

Sorry for my english,, so if you look at the screen i receive a mail from user@gmail.com but the hostname was not a google server and postfix or mailscanner don't block the message.

So how i can check if the hostname are the same as the sender address. And if not the same it's blocked by mailscanner?

[pdwalker]

I understand what you are trying to do now, and I recommend you not do this.

The biggest problem is, how do you know which servers are allowed to send mail for your domain or not? For example, CompanyX might use google mail for hosting their mail. Their domain will be "companyx.com" but the mail server would be "google.com". Would you reject that mail?

Fortunately, this has already been thought of and it is called SPF (or sender policy framework). SPF is a way to tell other mail servers which servers are allowed to send mail for your domain.

For example, I use messagelabs.com for filtering my email. Thus for my domain, example.com, I publish a DNS record that says "messagelabs.com" servers are allowed to send mail from my domain.

This feature is already built into EFA, and is taken into account when calculating the spam score.

Unfortunately, SPF is only given a small modifier to the spam score because most systems tend not to use it.

You can also consider using this plugin: viewtopic.php?f=14&t=1777 to help modify your score. This plugin compares the sending ip address class with the mx host ip address class to help determine if this message appears to come from a legitimate sender.

The author of this plugin also wrote another plugin that helps track and effectively whitelists email addresses your users are having conversations with. Highly recommended.

Both plugins can be found here: http://saplugin.16mb.com/

Hope this helps.

[wilbourne]

thank you for your help . I've found and resolved

[pdwalker]

Can you tell me what you did?

[wilbourne]

your last reply help me to solved this problem, before I received many fraudulent email while I had already a spf declared. But this entry was misconfigured so I changed.

with something like that:
before : v=spf1 include:"relay host" ?all

now : v=spf1 mx a ptr ip4: "ip address" a: "cname" include: "relay host" -all

[pdwalker]

Thank you for that.

I use ~all instead of -all because sometimes sites send email for their domains from other servers. For non spf matches, I just increase the spam score and I rely on the Bayesian filtering to reduce the spam score in the cases where the Mail is coming no fry a non spf authorized server but is still valid.

Keep an eye on your spam scores to ensure this isn't a problem for you.