Post #3477339
2026-06-29 20:37 UTC
@jjcelery@mastodon.ie spent a good deal of time fighting this specific demon with Postfix, and eventually resorted to writing a validation script and reading through settings until I _think_ I have it nailed. The only gap currently is questionable relays (i.e. someone sends email relay.doofus.com "from" and "to" me, and my server accepts it) and the only way I know of to kill this is to be brutal about SPF/DKIM. I have this on a test server and it seems to work.
Will post config snippet in followup.
Replies (1)
-
@ithoughtisawa2@infosec.exchange 2026-06-29 20:43
@waider@mastodon.ie @jjcelery@mastodon.ie I was going to say the same thing. This is exactly the problem SPF, DMARC and DKIM was designed to solve, validating that mail sent using your domain is only sent from servers you have authorized to do so. The last step is for you to configure your server to reject messages that fail these tests