Spam with faked user ID's
-
We recently see a lot of spam in where some spammer uses our Email adresses
In such a way that the persons name TO field replaced by one of our own email adresses
where one normally would see in the from field :
myfirstname.lastname <Myname@myorg.com>
This spammer creates FROM fields that look like :
Myfirstname.lastname@myorg.com <myname@spammer.com>Is there a way we can drop Emails server side in where the name contains our employees with our own email org added. Since we have a lot of employees i wonder if a general rule could somehow be made for this. So faked people who fake to be our own users dont get to people’s inboxes.
-
I have seen many companies start adding headers or email subject line rewrite rules to their spam filter to mark all emails from outside their domain as “EXTERNAL:”
That way it covers a most cases, including someone using coworker@my0rg.com and coworker@rnyorg.com.
-
In my case I made a rule in our SMTP Gateway dropping all incoming mails which have our maildomain in the senders address field.
Have a look at your Firewall/ Gateway/ UTM for that. Or if your Kopano server is accepting external mails directly, have a look at your Spamfilterconfig or you could use procmail for that.
