Facebook
Twitter
Robert S Tucker
New Pleskian
My mailboxes get emails from spoofed mail accounts which pass SPF an DMARC checks. e.g. mails from [email protected] even through this email address doesnt exist. How can I stop this?
-
If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
CentOS2Alma discussion
Issue Spoofed email addresses
- Thread starter Robert S Tucker
- Start date
This problem is happening a lot lately,
I don't know if there's anything that the Plesk team could do about it to avoid it, but it would be very helpful, because the spoofers/spammers are getting pretty slick in passing SPF, DKIM & DMARC checks
In the meantime, check the headers for this emails. With that info you could:
-Block the actual IP from the actual sender.
-Block the actual domain from the actual sender.
-Write custom spamassassin rule(s) so that the spoof emails get labeled as SPAM.
In my experience, unfortunately there's not a definitive answer to block all spoof emails once and for all, a rule/block that works this week might get bypassed next week.
I don't know if there's anything that the Plesk team could do about it to avoid it, but it would be very helpful, because the spoofers/spammers are getting pretty slick in passing SPF, DKIM & DMARC checks
In the meantime, check the headers for this emails. With that info you could:
-Block the actual IP from the actual sender.
-Block the actual domain from the actual sender.
-Write custom spamassassin rule(s) so that the spoof emails get labeled as SPAM.
In my experience, unfortunately there's not a definitive answer to block all spoof emails once and for all, a rule/block that works this week might get bypassed next week.
danami
Silver Pleskian
I suggest that you guys take a look at the SpamAssassin FromNameSpoof plugin. It should be simple to add it to your SpamAssassin setup:
In our Warden product we include it by default.
In our Warden product we include it by default.
