Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Prevent spoofing of "From:" header on shared hosting

Discussion in 'E-mail Discussions' started by Rodrigo Gomes, Mar 2, 2017.

Tags:
  1. Rodrigo Gomes

    Rodrigo Gomes Well-Known Member

    Joined:
    Apr 6, 2016
    Messages:
    88
    Likes Received:
    21
    Trophy Points:
    8
    Location:
    Brazil
    cPanel Access Level:
    Root Administrator
    I noticed that I can send valid SPF and DKIM emails from another account if the domain is hosted on the same server.

    For example:
    Let's assume I have intel.com and amd.com on the same cpanel server.

    email@intel.com from user intel
    Can send a fake email like email@amd.com with valid SPF and DKIM

    I know there is the option: Rewrite From: header to match actual sender
    But I would like to allow my customers to be able to send email as other accounts, as long as the domain is registered in their cpanel account.

    In summary, how do I prevent customers from sending email as other customers?
     
  2. Rodrigo Gomes

    Rodrigo Gomes Well-Known Member

    Joined:
    Apr 6, 2016
    Messages:
    88
    Likes Received:
    21
    Trophy Points:
    8
    Location:
    Brazil
    cPanel Access Level:
    Root Administrator
    I opened a ticket on this subject because I think one account could not send an email with DKIM from another account.

    If DKIM fails, it is possible to prevent abuses using DMARC.

    An internal case (CPANEL-11627) was opened by the support team.
     
    #2 Rodrigo Gomes, Mar 2, 2017
    Last edited: Mar 3, 2017
  3. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    38,659
    Likes Received:
    1,428
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello @Rodrigo Gomes,

    Thank you for updating this thread with the outcome of the support ticket.

    I'm monitoring CPANEL-11627 and will update this thread with more information on the status of this case as it becomes available.

    Thank you.
     
    Rodrigo Gomes likes this.
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    38,659
    Likes Received:
    1,428
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    To update, this behavior was determined to be by-design. The proper method to address this concern is to enable the following option under the "Mail" tab in "WHM >> Exim Configuration Manager >> Basic Editor":

    EXPERIMENTAL: Rewrite From: header to match actual sender

    Per it's description:

    If you enabled this option, the From: header will be rewritten to be the email address of the actual message sender. If you choose the "remote" option, only messages that are being sent to remote destinations will be affected.

    I encourage you to open a feature request if you'd like to see additional functionality or preferences added to this option:

    Submit A Feature Request

    Thank you.
     
Loading...

Share This Page