We have the following in postfix's main.cf:
smtpd_recipient_restrictions= permit_sasl_authenticated, permit_mynetworks ... smtpd_sender_restrictions = permit_mynetworks, reject_sender_login_mismatch ...
yet we just received the following spam:
To: firstname.lastname@example.org From: <email@example.com> Return-Path: <firstname.lastname@example.org>
and that eveil Return-Path address does NOT display in email clients, at least NOT in thunderbird.
After much checking around, I can replicate the SMTP conversation as the following:
telnet mydomain.com 25 ... Escape character is '^]'. 220 mydomain.com ESMTP Postfix EHLO spammers.ru ... MAIL FROM:<email@example.com> 250 2.1.0 Ok RCPT TO:<firstname.lastname@example.org> 250 2.1.5 Ok DATA 354 End data with <CR><LF>.<CR><LF> To: email@example.com From: <firstname.lastname@example.org>
That is, even though we demand all email sent From our domain has to login as that account or from trusted network, that restriction only applies to the envelope MAIL FROM command. The spammer can just send from any outside domain, then still forge From address as from our domain in the email itself. And unfortunately email clients will display such email as From our trusted accounts.
How to deal with this?
Also this page explained that, the MAIL FROM address, email@example.com, is discarded and displayed as Return-Path: in the email header. So at least one can demand the From: address has to match Return-Path: in the email header, but looks like people discourage this? And is this possible to do in postfix conf at all or has to do in procmail etc?