2

I have got a question regarding how one can protect himself from fake e-mails that are forged by putting in a fake message header while keeping normal envelope header? The issue is that what is displayed in an e-mail system is the message header that is not really verified (see an example below):

data 354 End data with <CR><LF>.<CR><LF> From: Display this fake address <[email protected]> To: Recipient <[email protected]>

I can literally put anything in the From and To headers and this is what is going to be displayed to the recipient. This is because the verification steps are done for the "mail_from:" and "rcpt_to:" which might be genuine but the message itself is faked in the message headers.

Are there any steps one can take to verify message headers to check if a message is genuine?

Improve this question

1 Answer 1

Reset to default
1

What you are asking is about Email-spoofing. It is easy to do because the core protocols do not have any mechanism for authentication.

On postfix level, I don't think you can have any such configuration for spoof checking. But go through link postfix spoofed checking for better understanding.

To implement spoof checking, email service provider companies have their dedicated spam checking softwares, may be you should check with them.

Improve this answer
1
  • Hey I checked your link but I could not really find a policy that checks the message headers. I know that gmail has got this implemented in their web interface, but the question remains - Is there anything what is publicly available that could be implemented in smtpd_data_restrictions for example? Commented Oct 12, 2015 at 21:59

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.