How to reject SMTP send if From header doesn't match SMTP user?

[manoaratefy]

Good morning,

As the title says, How to reject SMTP send if From header doesn't match SMTP user?

Concretely, I want to disallow [email protected] to send emails with "From: [email protected]" in the header.

Thanks in advance.

 

[keat63]

I'l be honest, I'm not entirely sure that this is possible.
I'm pretty sure it's been discussed on here many times, although I could be wrong.

You could look in exim config at:


EXPERIMENTAL: Rewrite From: header to match actual sender [?]
If you enabled this option, the From: header will be rewritten to be the email address of the actual message sender. If you choose the "remote" option, only messages that are being sent to remote destinations will be affected.

 

[cPRex]

I think this is similar to the many "how to stop spoofing" threads that get created. You can't really prevent then with 100% certainty, but there are things you can do to help reduce the chances of them getting through. A few possible options are here:

Preventing spoofed emails

Symptoms If you've had an email delivered that was sent from your address, and you know you didn't send the message, that's an example of a spoofed email. These are often used in phishing scams or...

support.cpanel.net

but a search of the forums for "spoof" will give you many threads with different workarounds and recommendations that users have implemented over the years.

 

[manoaratefy]

Hello,

After a lot of searching, I decided to filter these email using Exim filter. So, I added /usr/local/cpanel/etc/exim/sysfilter/options/fail_from_dont_match_sender with the following content:

if $header_from: does not matches "" and
   $header_from: does not contains $sender_address
then
  fail text "From header doesn't match authenticated sender"
  seen finish
endif

I applied changes by enabling this filter on WHM > Service Configuration > Exim Configuration Manager but it doesn't work. I did something wrong?

 

[WasChristine]

Hello.

Does adjusting this line make any changes to the way that your filter works?:

if $header_from: does not matches "" and

Specifically changing "matches" to "match". We must note that our assistance on this matter is quite limited, though you may be able to get this to work through testing various changes in the custom filter.