That should already be configured by default. For instance, I could not configure the SMTP server in my email client with your server's hostname and use it to send email from a Gmail account. It would be denied due to the SMTP authentication requirement.
One would expect that to be configured but it quite definitely isn't and has over the last few months become a major point of spammer attack. They are stealing SMTP passwords from infected/trojanned user PCs and using them to send spam "from" external users (eg
[email protected]). Outgoing limits help a lot, but the spam still gets out, so our servers are getting blacklisted.
Obviously this is a major problem - I was contacted about this by one of the major email providers recently (ask me which one offline if you need more info, can provide internal contact point) - and it is being used to attack them in a huge way. For instance, the current round of attacks over easter was sending out emails as
[email protected]. (there were a lot of attacks from the posts here)
We need this fixed in the default cpanel config so that we are protected - possibly a check option to turn on would be great. The rule needs to be something like "only allow authenticated SMTP users to send from the current authenticated domain" (or perhaps, current authenticated email user).
While the "Experimental From" rule does tie the user to a correct email address nicely, I'd prefer to be able to drop or bounce this email as spam immediately. If the spam isn't sent in the first place, there's a lot less work for everyone and no risk of getting blacklisted.
If you have an exim ACL you could point us to that would be a great help as we're getting attacked right now. I understand that the above "Experimental From" helps, but it isn't a real solution as the spam still gets sent.
