sender spoof security problems

[5aaaaaaaa11]

telneting to Ironport external address on port 25，HELO and I am able to send mail to Success。

For example： mail from:CEO@mydomain.com   rcpt to: any@mydomain.com. 

Or mail from:any@any.com  rcpt to: any@mydomain.com

This is a huge security hole, but I dont know how to fix it.

[Jrod]

Try the ESA technotes:http://www.cisco.com/c/en/us/support/security/email-security-appliance/products-tech-notes-list.html

ESA Spoofed Mail Filtering

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117796-problemsolution-esa-00.html

[Mathew Huynh]

Hello,

This would be seen as normal port 25 traffic for SMTP communication if you did a port 25 connection.

Spoofing can be managed with the article Jared has high-lighted.

Also it is suggested to enable LDAP recipient validation to further protect your domain from emails going to senders which do not exist in your domain.

I would advise to go to the Online Help Guide on your ESA (GUI > Help and Support > Online Help)

Look for LDAP accept -- the guide will provide detailed information on this function and deployment for added security.

Regards,

Matthew