I recently received some strange spams on my mail server, i'm using zimbra 8.x. bundled with postfix.
I think i've secure postfix enough to avoid receiving spams from my own domain by an external smtp connection without authentication.
Here is the part of zimbra.log when some spammers are trying to send emails from my email address to my email address without smtp authentication.
Message ID '[reject:NOQUEUE:mail]' firstname.lastname@example.org --> email@example.com Recipient firstname.lastname@example.org Nov 19 12:24:41 - unknown (91.x.24.x) status reject 553 5.7.1 <email@example.com>: Sender address rejected: not logged in
They all get rejected, so theoretically i shouldn't be able to receive email coming from my own email address from spammers, except if my account has been hacked, which is not the case, i'll show you why in the logs.
The spammer used as sender an external email address, which is usual and then no authentication is needed in that case.
Nov 19 20:39:40 mail postfix/smtpd: NOQUEUE: filter: RCPT from hackzor.net[18.104.22.168]: <firstname.lastname@example.org>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:100 26; from=<email@example.com> to=<firstname.lastname@example.org> proto=ESMTP helo=<hackzor.net>
But the weird thing is that email in my inbox, the sender has changed to my own email address, here the header.
Return-Path: email@example.com Received: from mail.mydomain.com (LHLO mail.mydomain.com) (192.168.1.1) by mail.mydomain.com with LMTP; Mon, 19 Nov 2018 20:39:45 +0800 (CST) Received: from localhost (localhost [127.0.0.1]) by mail.mydomain.com (Postfix) with ESMTP id 60A105B459DE; Mon, 19 Nov 2018 20:39:45 +0800 (CST) X-Virus-Scanned: amavisd-new at mail.mydomain.com Received: from mail.mydomain.com ([127.0.0.1]) by localhost (mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yARN2OhX10-F; Mon, 19 Nov 2018 20:39:41 +0800 (CST) Received: from hackzor.net (hackzor.net [22.214.171.124]) by mail.mydomain.com (Postfix) with ESMTPS id 7325D5B459A3 for <firstname.lastname@example.org>; Mon, 19 Nov 2018 20:39:38 +0800 (CST) Received: by hackzor.net (Postfix, from userid 10000) id 28A931650A4; Mon, 19 Nov 2018 07:15:11 -0500 (EST) To: email@example.com Subject: firstname.lastname@example.org was hacked. X-PHP-Originating-Script: 10000:c.php MIME-Version: 1.0 Content-type:text/html;charset=UTF-8 From: email@example.com <firstname.lastname@example.org> Message-Id: <20181119121513.28A931650A4@hackzor.net> Date: Mon, 19 Nov 2018 07:15:11 -0500 (EST)
Does someone have a clue on how it's possible and how to avoid this kind of spoofing ?