cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
148
Views
5
Helpful
2
Replies
Highlighted
Beginner

sender spoof security problems

telneting to Ironport external address on port 25,HELO and I am able to send mail to Success。

For example: mail from:CEO@mydomain.com   rcpt to: any@mydomain.com. 

Or mail from:any@any.com  rcpt to: any@mydomain.com

This is a huge security hole, but I dont know how to fix it.

2 REPLIES 2
Highlighted
Beginner

Try the ESA technotes:http:/

Try the ESA technotes:http://www.cisco.com/c/en/us/support/security/email-security-appliance/products-tech-notes-list.html

ESA Spoofed Mail Filtering

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117796-problemsolution-esa-00.html

Highlighted
Cisco Employee

Hello,

Hello,


This would be seen as normal port 25 traffic for SMTP communication if you did a port 25 connection.

Spoofing can be managed with the article Jared has high-lighted.

Also it is suggested to enable LDAP recipient validation to further protect your domain from emails going to senders which do not exist in your domain.

I would advise to go to the Online Help Guide on your ESA (GUI > Help and Support > Online Help)

Look for LDAP accept -- the guide will provide detailed information on this function and deployment for added security.

Regards,

Matthew