1

I recently received some strange spams on my mail server, i'm using zimbra 8.x. bundled with postfix.

I think i've secure postfix enough to avoid receiving spams from my own domain by an external smtp connection without authentication.

Here is the part of zimbra.log when some spammers are trying to send emails from my email address to my email address without smtp authentication.

Message ID '[reject:NOQUEUE:mail]'
virginie@mydomain.com -->
    virginie@mydomain.com
  Recipient virginie@mydomain.com
  Nov 19 12:24:41 - unknown (91.x.24.x) status reject
    553 5.7.1 <virginie@mydomain.com>: Sender address rejected: not logged in

They all get rejected, so theoretically i shouldn't be able to receive email coming from my own email address from spammers, except if my account has been hacked, which is not the case, i'll show you why in the logs.

The spammer used as sender an external email address, which is usual and then no authentication is needed in that case.

Nov 19 20:39:40 mail postfix/smtpd[4733]: NOQUEUE: filter: RCPT from hackzor.net[185.24.1.1]: <spammer@hackzor.net>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:100
26; from=<spammer@hackzor.net> to=<virginie@mydomain.com> proto=ESMTP helo=<hackzor.net>

But the weird thing is that email in my inbox, the sender has changed to my own email address, here the header.

Return-Path: spammer@hackzor.net
Received: from mail.mydomain.com (LHLO mail.mydomain.com) (192.168.1.1) by
 mail.mydomain.com with LMTP; Mon, 19 Nov 2018 20:39:45 +0800 (CST)
Received: from localhost (localhost [127.0.0.1])
    by mail.mydomain.com (Postfix) with ESMTP id 60A105B459DE;
    Mon, 19 Nov 2018 20:39:45 +0800 (CST)
X-Virus-Scanned: amavisd-new at mail.mydomain.com
Received: from mail.mydomain.com ([127.0.0.1])
    by localhost (mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id yARN2OhX10-F; Mon, 19 Nov 2018 20:39:41 +0800 (CST)
Received: from hackzor.net (hackzor.net [185.24.1.1])
    by mail.mydomain.com (Postfix) with ESMTPS id 7325D5B459A3
    for <virginie@mydomain.com>; Mon, 19 Nov 2018 20:39:38 +0800 (CST)
Received: by hackzor.net (Postfix, from userid 10000)
    id 28A931650A4; Mon, 19 Nov 2018 07:15:11 -0500 (EST)
To: virginie@mydomain.com
Subject: virginie@mydomain.com was hacked.
X-PHP-Originating-Script: 10000:c.php
MIME-Version: 1.0
Content-type:text/html;charset=UTF-8
From: virginie@mydomain.com <virginie@mydomain.com>
Message-Id: <20181119121513.28A931650A4@hackzor.net>
Date: Mon, 19 Nov 2018 07:15:11 -0500 (EST)

Does someone have a clue on how it's possible and how to avoid this kind of spoofing ?

Bye

closed as too broad by Ramhound, Burgi, bertieb, music2myear, K7AAY Nov 28 '18 at 17:04

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Look up email spoofing. Not uncommon. – JakeGould Nov 21 '18 at 2:54
  • 1
    An SPF record in your DNS is a good start and easy to do. Combine that with DKIM for better protection. – davidgo Nov 21 '18 at 6:26
  • Unfortunately, i cannot implement SPF verification, many of our customers / suppliers doesn't use it. :((( – user3723669 Nov 21 '18 at 7:29