This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Stop Spoofed mail from FakeMail websites

Hi,

We are using Sophos UTM 9.204-20 and have the EMail Protection Module.

Mail generated using spoofing websites like from emkei.cz and deadfake.com is being allowed to pass through. I tried spoofing our own domain as well as another domain. It is always being allowed to pass through. We have everything switched on in AntiSpam (ie: RDNS, BATV, RBL, Greylisting, SPF check), and it still is being allowed to pass.

The only solution is to Blacklist the whole domain (ex: Blacklist emkei.cz), but I hardly call that a solution as I don't know every domain that can be used to spoof senders and spoofed mail can really come from anywhere.

Is there a way to block these? I would have thought that a RDNS check would have instantly blocked these, but somehow they are being allowed.

This thread was automatically locked due to age.

Parents

0 JimKoerner over 9 years ago

Actually looks like I posted almost the same question.
https://community.sophos.com/products/unified-threat-management/astaroorg/f/56/t/49949

SPF only helps with the MAIL FROM(envelope sender address) in the P1 header and not the FROM(header sender address) in the p2 header. In my case SPF is picking off impersonation in the MAIL FROM but users will get emails that look like they came from themselves. If I look at the envelope header the mail came from a legit server so SPF doesn't help.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 JimKoerner over 9 years ago

Actually looks like I posted almost the same question.
https://community.sophos.com/products/unified-threat-management/astaroorg/f/56/t/49949

SPF only helps with the MAIL FROM(envelope sender address) in the P1 header and not the FROM(header sender address) in the p2 header. In my case SPF is picking off impersonation in the MAIL FROM but users will get emails that look like they came from themselves. If I look at the envelope header the mail came from a legit server so SPF doesn't help.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 MentalMickey over 9 years ago in reply to JimKoerner

Actually looks like I posted almost the same question.
https://www.astaro.org/gateway-products/mail-protection-smtp-pop3-antispam-antivirus/59261-block-emails-spoofed-p2-headers.html

SPF only helps with the MAIL FROM(envelope sender address) in the P1 header and not the FROM(header sender address) in the p2 header. In my case SPF is picking off impersonation in the MAIL FROM but users will get emails that look like they came from themselves. If I look at the envelope header the mail came from a legit server so SPF doesn't help.

Ahh, I see that now. Quite sneaky that. Must have a poke around and see what happens when I do that on another system.
Cancel
Vote Up 0 Vote Down

Cancel