Post #3477340
2026-06-29 20:27 UTC
Help needed:
Joys of running a mail server, right. I have a postfix/dovecot setup and SMTP locked down to require authentication to send emails but I'm getting spoofed sender spam emails.
You know the kind: email looks like it's coming from your own mailbox and is sent to your own mailbox, and threatens with reputation damage unless you pay.
With SMTP locked down I was surprised I'm still getting them. Lo! Behold! they're using LMTP.
Any clues on how to stop these?
#infosec #SelfHost
Replies (1)
-
@waider@mastodon.ie 2026-06-29 20:37
@jjcelery@mastodon.ie spent a good deal of time fighting this specific demon with Postfix, and eventually resorted to writing a validation script and reading through settings until I _think_ I have it nailed. The only gap currently is questionable relays (i.e. someone sends email relay.doofus.com "from" and "to" me, and my server accepts it) and the only way I know of to kill this is to be brutal about SPF/DKIM. I have this on a test server and it seems to work. Will post config snippet in followup.