how do i prevent spam from myself

[allengcs]

I'm getting spammed to death by spammers that put their return address as either my address or a fake address from my domain. They seem to be using this trick to get around the SPF checking we have turned on.

Is there a way to prevent email being sent with a 'from' that is my domain without them being logged in?

[rob]

There is a option within the the SPAM settings that allows you to do just this called "Use Sender Domain Check". Enabling this will reduce SPAM that fakes mail from your own domains.

[allengcs]

I realize that. I'm asking about when someone is spamming ME from my OWN domain. Basically I'm trying to prevent someone from sending mail to my domaim 'FROM' my domain without being logged in.

[rob]

The feature that I mentioned is intended to do just that. Sorry for repeating myself but basically the option will enforce that to receive mail from your own domain, the user must be logged in and must use a valid email address too. This means that any SPAM source that fakes your domain as a email address, it will not be permitted unless they have relaying access. It is essentially your own personal SPF system.

[allengcs]

I realize this. But I have that option on and it's still happening. Can I send you the email that I'm getting spammed with to see if you can figure out why it's getting past?

[rob]

No problem, send the email to rob@code-crafters.com. I would recommend that you send the original raw email file (the text file) as an attachment, which can be found directly within your inbox folder.

[Adrian]

Hi everybody.
Any updates to this thread?
I wrote some weeks ago because the same was (and still is) happening to me.
Any ideas would be appreciated. Thanks!

[Jodrik]

Properly implemented SPF and Use Sender Domain Check should be all that is needed to fix this.

The most common issue here is that people are not actually e-mailing you FROM your own address, simply stating that it is you / your domain and it not being true.

A novel way to prevent this is simply making a custom filter that checks wether you FROM address and the actual address used to recieve the mail is the same. This filter should check the "Header Line Matches" with the FROM address being contained somewhere in the ####FROMADDRESS####,

Note that you should test this first, for I just randomly came up with this out of the top of my head. I'd advice to start of by using this filter to set some additional HEADER tag, to see if it works for your mails for a couple of days and then use it to take action (i.e. setting SPAM flags or whatever)

[robwaite]

I'm having the same problem. On occasion I too get mail from myself and others on the server also seem to be getting mail from me as well. There are no security issues on the server, this seems to be more of a recent thing. It's particular bad as I am the mail admin so users tend to trust emails reporting to be sent from me.

I have SPF check enabled.

[rob]

SPF is indeed a great way to reduce the 'self' SPAM. However, to allow SPF to help prevent those 'self' emails, it is important that you also have enabled SPF records for your domain (as well as having the feature enabled within AMS). The mail server will then automatically enforce the rules set by the SPF record and help reduce those SPAM's.

[robwaite]

Hi, just a quick update. I have sorted out my TXT records for the SPF check and since I have done this, I’ve not received a single spam email coming through posing as though it was sent from one of our domain users.

Good Times.