Rejecting false "mail from" addresses

    Rejecting false "mail from" addresses

1.-Zimbra Collaboration 8.5 and above Please use the next commands to increase the security and reject the logins for users that doesn't exist in the LDAP:

    zmprov mcf zimbraMtaSmtpdRejectUnlistedRecipient yes 
    zmprov mcf zimbraMtaSmtpdRejectUnlistedSender yes 
    zmmtactl restart 
    zmconfigdctl restart

2.- For Zimbra Collaboration 8.0.x and previous

      Open the file /opt/zimbra/conf/zmconfigd/smtpd_sender_restrictions.cf and add this line into the middle of the file, prior to the tag_as_foreign.re lines: Add this: 
      check_sender_access hash:/opt/zimbra/conf/domainrestrict

It should look like this.. check_sender_access hash:/opt/zimbra/conf/domainrestrict %%contains VAR:zimbraServiceEnabled antivirus^ check_sender_access regexp:/opt/zimbra/postfix/conf/tag_as_foreign.re%%

3. Zimbra Collaboration 7.x You should follow the next steps:

     su - zimbra 
     zmlocalconfig -e postfix_smtpd_sender_restrictions="reject_unknown_sender_domain, permit_mynetworks, permit_sasl_authenticated, check_sender_access hash:/opt/zimbra/conf/domainrestrict, permit"

4.-Remaining steps are same for ZCS 8.0.x and previous versions

i.-Create the file "/opt/zimbra/conf/domainrestrict" and add your domain(s) to it.

localdomain.com REJECT

      anotherlocaldomain.com   REJECT

ii.- Create the hash database of "/opt/zimbra/conf/domainrestrict". Run as 'zimbra' user.

        postmap  /opt/zimbra/conf/domainrestrict

iii.- Restart zmmtactl.

       zmmtactl stop 
       zmmtactl start

5.- Testing

i.- Make following connection from a non-local host which is not part of mynetworks. 
       telnet ZCS_server_address 25 
        mail from: user@localdomain.com 
        rcpt to: user2@localdomain.com

ii.- You should get following error at the rcpt command if you used the Zimbra Collaboration 8.6 steps:

         550 5.1.0 <hi@example.com>: Sender address rejected: example.com

iii.- You should get following error at the rcpt command

          554 5.7.1 <user@localdomain.com>: Sender address rejected: You're not me!