dovecot - Oct 2012 - Emails from invalid local accounts

Hi,

I'm using dovecot 1.2.9 in a postfix/dovecot setup and I'm having issues
with receiving spam where the "from" header contains an address like
accounting at mydomain.com.  Is there some way I can filter out these emails
coming from outside our network with an account associated with our network
which doesn't exist?  Do I just need to configure some custom process to
evaluate these addresses, or is there some way either in dovecot or
spamassassin to do this?

Thanks,

Steve K

On 10/18/2012 3:32 PM, Steven Kiehl wrote:
> Hi,
>
> I'm using dovecot 1.2.9 in a postfix/dovecot setup and I'm having
issues
> with receiving spam where the "from" header contains an address
like
> accounting at mydomain.com.  Is there some way I can filter out these
emails
> coming from outside our network with an account associated with our network
> which doesn't exist?  Do I just need to configure some custom process
to
> evaluate these addresses, or is there some way either in dovecot or
> spamassassin to do this?
>
> Thanks,
>
> Steve K
>
This should be dealt with in postfix or SpamAssassin, not dovecot,
and there are likely other, better ways to detect this particular
spam rather than mucking with the From: header.

Sometimes mail arrives with a header something like
  From: accounting
and postfix appends @$myorigin to the unqualified address while
passing the mail through your content_filter.

The fix for that is to set in your postfix main.cf
  remote_header_rewrite_domain = domain.invalid
so that unqualified addresses will be rewritten with a known
domain.  Don't be tempted to reject such mail outright since you'll
reject a significant amount of non-spam mail.

Another thing to consider setting in postfix main.cf is:
  smtpd_reject_unlisted_sender = yes
which will reject invalid envelope senders in your domain.  (Note
the difference between envelope sender and the From: header.)



  -- Noel Jones

At  4PM -0400 on 18/10/12 you (Steven Kiehl) wrote:
> 
> I'm using dovecot 1.2.9 in a postfix/dovecot setup and I'm having
issues
> with receiving spam where the "from" header contains an address
like
> accounting at mydomain.com.  Is there some way I can filter out these
emails
> coming from outside our network with an account associated with our network
> which doesn't exist?  Do I just need to configure some custom process
to
> evaluate these addresses, or is there some way either in dovecot or
> spamassassin to do this?
You want to do this in Postfix, with either the
smtpd_reject_unlisted_sender parameter or the reject_unlisted_sender
policy in smtpd_sender_restrictions. You will need to make sure Postfix
has access to the list of valid mailboxes at your domain, which it
should have already for recipient checking.

Ben