• Please be aware: Kaspersky Anti-Virus has been deprecated
    With the upgrade to Plesk Obsidian 18.0.64, "Kaspersky Anti-Virus for Servers" will be automatically removed from the servers it is installed on. We recommend that you migrate to Sophos Anti-Virus for Servers.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.

Question non-existence users can send email

rout3rx

Basic Pleskian
hello
as a picture bellow i my plesk mail server, [email protected] could send email to existence users!
how can i block ?
in the picture bellow user : 2221 is not valid but can send email!

tempsnip.png

please help.
thanks
 
I assume that most people who read this are afraid to answer with a simple: There is not way, it cannot be done. Because there will be some way for sure, but it is probably complicated enough that comes close to a "it cannot be done".

Basically, an email sender can place anything she wants into the from field. At least the visible part. It is also possible to send emails with forged senders in the invisible part, because when email was invented, the inventors did not take all the criminals into account who are prone to abuse the Internet for their nasty stuff by the millions each day.

If you are receiving the mails from a local account (one that is located on the same server), I suggest to ask the user to stop or to leave. If you are receiving such mails from an external source, I recommend to use SPF lookup in the general mail settings to block all incoming mails that have no SPF record in their domains or an SPF record that does not match the sender's IP address. This will block most of such forged mails.
 
Unfortunately that will block most non-forged mails too as very many senders still don't have a SPF and/or DKIM record.

And blocking just mails where SPF fails (when you have a SPF record yourself) still doesn't help against this kind of abuse: While it would seem that it should block external senders from sending mail that appear to be from your domain, to pass SPF, it is enough for the sender information in that invisible part Peter mentioned (the "smtp envelope") to be acceptable by another domain's SPF settings.
 
Back
Top