Merge #2479
2479: Rework the anti-spoofing rule r=mergify[bot] a=nextgens ## What type of PR? Feature ## What does this PR do? We shouldn't assume that Mailu is the only MTA allowed to send emails on behalf of the domains it hosts. We should also ensure that it's non-trivial for email-spoofing of hosted domains to happen Previously we were preventing any spoofing of the envelope from; Now we are preventing spoofing of both the envelope from and the header from unless some form of authentication passes (is a RELAYHOST, SPF, DKIM, ARC) ### Related issue(s) - close #2475 ## Prerequisites Before we can consider review and merge, please make sure the following list is done and checked. If an entry in not applicable, you can check it or remove it from the list. - [x] In case of feature or enhancement: documentation updated accordingly - [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file. Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>main
commit
0839490beb
@ -0,0 +1,17 @@
|
||||
rules {
|
||||
ANTISPOOF_NOAUTH {
|
||||
action = "reject";
|
||||
expression = "!MAILLIST & ((IS_LOCAL_DOMAIN_E & MISSING_FROM) | (IS_LOCAL_DOMAIN_H & (R_DKIM_NA & R_SPF_NA & DMARC_NA & ARC_NA)))";
|
||||
message = "Rejected (anti-spoofing: noauth). Please setup DMARC with DKIM or SPF if you want to send emails from your domain from other servers.";
|
||||
}
|
||||
ANTISPOOF_DMARC_ENFORCE_LOCAL {
|
||||
action = "reject";
|
||||
expression = "!MAILLIST & (IS_LOCAL_DOMAIN_H | IS_LOCAL_DOMAIN_E) & (DMARC_POLICY_SOFTFAIL | DMARC_POLICY_REJECT | DMARC_POLICY_QUARANTINE | DMARC_NA)";
|
||||
message = "Rejected (anti-spoofing: DMARC compliance is enforced for local domains, regardless of the policy setting)";
|
||||
}
|
||||
ANTISPOOF_AUTH_FAILED {
|
||||
action = "reject";
|
||||
expression = "!MAILLIST & BLACKLIST_ANTISPOOF";
|
||||
message = "Rejected (anti-spoofing: auth-failed)";
|
||||
}
|
||||
}
|
@ -0,0 +1,11 @@
|
||||
IS_LOCAL_DOMAIN_H {
|
||||
type = "selector"
|
||||
selector = "from('mime'):domain";
|
||||
map = "http://{{ ADMIN_ADDRESS }}/internal/rspamd/local_domains";
|
||||
}
|
||||
|
||||
IS_LOCAL_DOMAIN_E {
|
||||
type = "selector"
|
||||
selector = "from('smtp'):domain";
|
||||
map = "http://{{ ADMIN_ADDRESS }}/internal/rspamd/local_domains";
|
||||
}
|
@ -0,0 +1,8 @@
|
||||
rules {
|
||||
BLACKLIST_ANTISPOOF = {
|
||||
valid_dmarc = true;
|
||||
blacklist = true;
|
||||
domains = "http://{{ ADMIN_ADDRESS }}/internal/rspamd/local_domains";
|
||||
score = 0.0;
|
||||
}
|
||||
}
|
@ -0,0 +1 @@
|
||||
Upgrade the anti-spoofing rule. We shouldn't assume that Mailu is the only MTA allowed to send emails on behalf of the domains it hosts... but we should also ensure that both the envelope from and header from are checked.
|
Loading…
Reference in New Issue