Block emails spoofed p2 headers

Hey Jim, 

I'm having the same issue with spoofed emails using the FROM in the P2 header, so I decided to kill them by removing the ms-exch-smtp-accept-authoritative-domain-sender permissions on my receive connector. But now UTM is not able to send Quarantine reports, as UTM sends the reports to that receive connector using one of our email addresses and Exchange is rejecting them now.

How are you handling the Quarantine reports after changing those permissions on the Exchange receive connector?

Thanks!

Wouldn't enabling SPF help with this?

I have SPF enabled on UTM and have SPF records set up for my domain. The thing is UTM uses SPF to check only the MAIL FROM field on the P1 headers of an email. Emails can still be spoofed by altering the FROM field on the P2 headers of an email. Unfortunately, UTM does not check P2 headers of emails, thus allowing spoofed emails to still come through. 

See my posts above from 21,22 Sep 2015.  The problem is that the From field comes after the DATA command.  Only the Sender field is considered for email-address blacklists, DKIM and SPF.

Cheers - Bob

By design, SPF is checked during the HELO.   No compliant SPF implementation will detect what you want.

It seems lime a regular expression pattern match might achieve your objective.

You should be aware that a vast amount of legitimate mail is sent by third party services, and in most of those cases the P1 and P2 domains will not match.

Technically, the P1 information is supposed to be the identity of the user account which generated the message.   At some websites, if it knows you by your email address, and you use it to generate an email, it may send with your email address as P1.   I have given up on SPF.

Doug, please vote for and comment on: In Anti-Spam, Expression-check everything after DATA or include From

Cheers - Bob