OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: HELO / MAIL FROM vs client
From: Johan Almqvist (johan-postfixalmqvist.net)
Date: Tue Jul 04 2000 - 08:46:07 CDT

On Tue, Jul 04, 2000 at 03:33:01PM +0200, Gert-Jan Looy wrote:
> Someone connecting from the outside to our firewall-postfix
> and then sending mail with "MAIL FROM: someonesiemens.nl" ,
> so that the recipient thinks that the mail really comes
> from Siemens , which it does not.
>
> What I would like is to match the clients real domain with the domain
> entered in the "helo" and "mail from" entries.
>
> Is this possible?

Even if this is possible it isn't a good idea: I, for example, send my
mail with MAIL FROM: almqvist.net but my machine's name is actually
(if reverse-lookupped) alpha.lunds.lu.se. Still, I think you might want
to have this message - and I want to have this envelope sender.

If someone pretends to "live" in your domain, legal action may be an idea.
On the firewall mailserver, you could also consider rejecting all mail from
the siemens.nl domain that comes in on the "public interface" - if you are
sure that no-one of you co-workers at Siemens does what I do as described
in the paragraph above.

-Johan 

-- 
Johan Almqvist