Dotaz: Postfix, amavis a servery co splnuji SPF a DKIM, ale evenlope se lisi od From.

[svaca]

Ahoj, nesetkal jste se nekdo s tim, jak vyresit a zablokovat tento spam ?

Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=185.34.55.132; helo=mail3.ezeph.com; envelope-from=bounce@ezeph.com; receiver=it@firma.cz 
Received: from mail3.ezeph.com (mail3.ezeph.com [185.34.55.132])
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mailer; d=ezeph.com;
 h=Message-ID:Date:Subject:From:Reply-To:To:MIME-Version:Content-Type:List-Unsubscribe:List-Id;
 bh=pCaU/YCDlr45D+by9kn6WQYcAZc=;
 b=qytQsZjlkC/se71sMr67UxJMQbJTQ4RKeuJPjqCfzceP/hYEOM2Cw2KEUz8E0K269bsLH5rBb4eV
   HkAPtrbmVTMxfHv/lsR4m7tWkZ6IwN7Hqg4mXAKBjlJ4Zd0ruxAizY6xYXB4PQU94nvfc2AUmOhS
   bqbyPHD9h9Lgac0ka2A=
Received: from ezeph.com (185.111.182.64) by mail3.ezeph.com id hkv1r00001gh
 for ; Thu, 31 Aug 2017 10:56:59 +0300 (envelope-from)
DKIM-Signature: v=1; a=rsa-sha1; bh=pCaU/YCDlr45D+by9kn6WQYcAZc=; d=ezeph.com;
 h=Message-ID: Date: Subject: From: Reply-To: To: MIME-Version: Content-Type:
 Precedence: List-Unsubscribe: List-Id: Feedback-ID; i=@ezeph.com; s=mailer;
 c=relaxed/relaxed; t=1504166221;
 b=ISh92Br6KoEY2mXYqKyyIzWDwdkyOZHT1r+TJNBuL55L4KvS2P05olzb9/wQsAXERgXkeMUwD
 R0ifjLtlJPfQM6xlLRafEyesqgf00GJE4T1rUfkFZHQ8nJe1WDE6chTc/ARaTOsfInwOllhxX
 jU7dNNk0NZoHJWkWpeAMHT6WI=
Message-ID: <59aafcd595a149e9e8aa201c787083eb@ezeph.com>
Date: Thu, 31 Aug 2017 07:57:01 +0000
Subject: This is going to be interesting...
From: Sandra Cates 
Reply-To: Sandra Cates 
To: "it@firma.cz" 

Odesilatel totiz splnuje SPF, DKIM a pod, ale posila takovyto sajrajt. Jak s timto nalozit ? Diky.

Odpovědi

[NN]

Pres header_checks?

[Filip Jirsák]

Blokovat ho na základě použitého DKIM klíče. K tomu celé DKIM slouží – aby byl odesílatel jednoznačně identifikován ale bylo jej tedy možné zablokovat.

[svaca]

Filipe: No jo, to me nenapadlo, nasadil jsem Tebou zatracovany DMARC a ten to zvlada...

Musim si nekde vyggoglit, jak se to dela pres ten dkim, to vubec nevim, ze dkim umoznuje blokaci na zaklade klice ...

[j]

Pripadne zabanujes servery/domenu na zaklade toho spf, k tomu slouzi to spf ...

A vyhodny je to v tom, ze i pokud se v dns spf zmeni, tak se zaroven u tebe zmeni seznam blokovanych serveru. Pokud na to nemas nejakej tool, da se to primitivne udelat scriptem v cronovi, kterej ti bude rekneme 1x za hodinu generovat seznam zablokovanych serveru ze seznamu zablokovanych domen a to pak predhodis primo postfixu, kterej se s tema serverama nebude vubec bavit.

A je to jeste lepsi nez resit klice, protoze ten mail nemusis vubec prijmout.