On 8/15/2011 10:29 AM, Drizzt wrote: > Hi, > > I have a setup whereby we check for spoofing. That is, anyone using an > envelope from in our domain is blocked. In a similar fashion we stop our > own hosts from spoofing others. > > For reference: > - external spoofing: > check_sender_access: mysql /etc/postfix/mysql-spoofing.cf > - internal spoofing > check_client_access + check_sender_access (by use of custom restriction class)
Yes, we do something similar. > > This works fine, and as I see it there is no reason why anyone should > ever use spoofing (of a domain, not their own). > > However, as things go in business, we have the request that: > - We must allow internal hosts to spoof (e.g. gmail) We have a short list of "allowed" outgoing sender domains. This is not a totally unreasonable request, and is allowed on most domains where there are no such restrictions. > - We must allow other parties to spoof us (marketing e-mails send out by > bulk hosts) > > In effect removing these restrictions (are introduce exceptions that > open up complete network segments). > > Input from the marking company reads: It is common to do this. (My > internal voice says: for spam hosts you mean). It's very common for your marketing company to use your name in the From: header, but not the envelope. They must set the envelope to their own domain so they can properly process delivery errors. Every legit marketer I'm aware of uses their own domain for the envelope sender. It is also possible the person you're talking to may not know the difference between envelope and header. > > My question in short: > Should I allow this? They can put in the header whatever they want as > long as they leave the envelope sane. Educate the decision makers about why you think it's a bad idea, and what the consequences might be. But this particular issue isn't worth a big fight. -- Noel Jones
