Hi,
We have the same issue and there are two solutions that I am aware of.
1) Enable DMARC along with your SPF. DMARC is designed to check the other headers (Display From) and check for authorized sending servers. It should rectify this.
2) This is the current method we are using and it seems to be working.
It involves setting up a dictionary containing your Companies Domains. This will be the list that is compared to the incoming email addresses (includes the PRA headers) and if the domain is in the list then it will be quarantined.
You will need to add the other servers that might send on your behalf (if you have a cloud archiving tool, website, newsletter etc) to the WHITELIST/Relaylist under the HAT table.
Here is what I did
* Setup "Internal_Domains_Quarantine" Quarantines on both devices (cluster)
* Setup a dictionary called "Internal_Domains" and added all of our Internal domains. NOTE you should end the domains with $, ie domain.com should be domain.com$ to ensure the domain.com is at the end of the address....this ensures that the emails bouncexxxxjohn.smith=domain.com@senderdomain.com aren't held (as some MTA's use this to stop invalid bounces).
* Add the extra servers to the Relay or Whitelist. For example I would have added 199.202.66.0/24 to the "Relaylist" as we have a cloud archiving solution which sends on our behalf and we dont want these to be stopped.
* Log into the CLI (has to be done through CLI) - Just SSH to your Box.
- Login with an admin account
- Type "filters"
- [You may have to switch to cluster mode. If so pick option 1]
- Type "NEW"
- Paste in the following
Quarantine_Spoofed: if
((mail-from-dictionary-match("Internal_Domains", 1)) OR
(header-dictionary-match("Internal_Domains","From", 1))) AND ((sendergroup !=
"RELAYLIST") AND (sendergroup != "WHITELIST")) {
quarantine("Internal_Domains_Quarantine");
}
.
[Note the "." finishes and should bring you back to the prompt]
- You will need to commit the changes so go back to the main prompt and type "commit" .
As this is probably a live environment it might be a good call to test this on a test or low volume domain and see if it responds as expected.
It is also a good call to keep checking the Quarantine and make sure no valid emails are being caught from say newsletters etc.
You can add a notification piece to notify the user/yourself etc if you like.
If you run into trouble, Login to the CLI again, Type "filters" , go to cluster [1], type "Delete" and select the filter you want to remove.
Then commit the changes and that filter should be removed.
Hope that helps.
