Block spoofing emails

Hi,

I recommend setting SPF-records for your domain and enabling "Perfom SPF check" in SMTP->Antispam.

Hi Josef, thank you for your reply. 

SPF is always enabled and records are update-to-date, this seems to be an open relay problem in UTM.

can you show us your smtp/relaying configuration?

please hide your domain names...

Thank you for your reply, are you referring to this page?

Config looks ok.

You should do an "open-relay-test" (included here https://mxtoolbox.com/diagnostic.aspx ) and check the mail-log afterwards.

You should see "relay not permitted" for the mail from supertool@mxtoolboxsmtpdiag.com to test@mxtoolboxsmtpdiag.com

... but your mailsystem is configured to receive mail for users within your domain ... and it don't check if the sender is from your domain too. (may be, anoter location of your domain send the mail .. this may be ok)
If you activate SPF-check and SPF is configured ok and there is no exception ... the system should not accept mails from mail servers not included within the SPF-record.
You may PM me your domain and i will check the SPF record.

Hi dirkkotte, 

I can confirm the SPF is configured ok, we tested it many times on different testing sites and there are no issues.

I did the "open-relay-test" as you suggested, which seems to be an open relay, any suggestions on how to fix it in UTM, our MX records are all pointing to the UTM 9 server

This kooks like my installations.

Please check the UTM-Mail-log (within mail-manager). There i have "blocked - relay not permitted"

Do you really activate SPF filtering at UTM?

Yes, SPF filter is enabled 

I cannot see "blocked - relay not permitted" in Mail Manager.

just send an email from an external source as postmaster@yourdomain through the firewall and you have your open relay... no checks at all will be applied...