Block other domains
Hello,
Here is our version (In process of upgrading to 6.2):
iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003)
libimta.so 5.2 HotFix 1.16 (built 12:32:17, May 14 2003)
What we are starting to see in our mail.log_current is users sending e-mail that is not generated from our domain. A better explanation. Say our domain is abc.com. We are seeing user modify their mail clients to say the mail is from xyz.com. Because the mail client is internal, the mail is allowed to be sent.
What we would like to do is to only allow mail sent from abc.com to be sent and all other mail domains to be rejected. This is what we are currently looking at doing:
ORIG_SEND_ACCESS
tcp_*|*@abc.com|*|* $Y
tcp_*|*|*|* $N
tcp_local|*|tcp_local|* $N$D30|Relaying$ not$ allowed
tcp_*|*|native|* $N
tcp_*|*|hold|* $N
tcp_*|*|pipe|* $N
tcp_*|*|ims-ms|* $N
Would this work or is there a better solution?
Thanks in advance,
Doug
Message was edited by:
fords4us
Message was edited by:
fords4us
[1113 byte] By [
fords4usa] at [2007-11-27 1:39:12]
# 1
There are many ways to address your issue. It is possible that some of your users have a legitimate reason to change return addresses to a differeent domain . . .
What many sites do, is:
1. Force internal users to authenticate.
2. Replace "from" with the authenticated address.
# 2
Hi,
> What we are starting to see in our mail.log_current
> is users sending e-mail that is not generated from
> our domain. A better explanation. Say our domain is
> abc.com. We are seeing user modify their mail
> clients to say the mail is from xyz.com. Because the
> mail client is internal, the mail is allowed to be
> sent.
By internal, I assume you mean is defined as internal based on the INTERNAL_IP mapping table?
Also, do you know why users are doing this. If they have a good reason, why stop it?
> What we would like to do is to only allow mail sent
> from abc.com to be sent and all other mail domains to
> be rejected. This is what we are currently looking
> at doing:
>
> ORIG_SEND_ACCESS
>
>tcp_*|*@abc.com|*|* $Y
> tcp_*|*|*|* $N
-> I wouldn't recommend this, the second line is going to block _all_ email that doesn't come from @abc.com, that includes email from outside your organisation (tcp_local e.g. from gmail.com) to your local users.
> tcp_local|*|tcp_local|* $N$D30|Relaying$ not$
> allowed
> tcp_*|*|native|* $N
> tcp_*|*|hold|* $N
> tcp_*|*|pipe|* $N
> tcp_*|*|ims-ms|* $N
>
> Would this work or is there a better solution?
I go with what Jay said. If you can enforce smtp authentication, then you could at least add for example a "Sender" header to the email so the recipient knows the 'real' address of the sender.
Force rewriting the From: address is not advised as it will cause customer complaints due to their emails being changed 'big-brother' style.
Forcing authentication gives you the option of finding out exactly who is sending the email using a different address (log the username used to authenticate) and then you send a polite 'please explain' email. I have found this to be personally the most effective path in the past.
Regards,
Shane.
