33 Comments

1. 

   Tom on 2015-04-06 at 15:49

   When I add the code above in the box: custom_begin_outgoing_notsmtp_checkall I get an error:

   error in ACL: unknown ACL condition/modifier in +local_domains : +remote_domains

   Reply
   • 

     Visakh S on 2015-04-07 at 04:38

     Hi Tom,

     Thanks for the comment.

     I see that you have entered the details in right place. The issue may be due to any of the following:

     1. Unwanted space in code. That is, there shouldn’t be any space before +local_domains in the code.

     Please try using the following:

     deny
     condition = ${if ! match_domain{${domain:${address:$h_From:}}}{+local_domains : +remote_domains}}
     message = Sorry, you don't have
     permission to send email from this server with a header that
     states the email is from ${lc:${domain:${address:$h_from:}}}.
     accept
     

     2. The below entry might be missing:

     domainlist remote_domains = lsearch;/etc/remotedomains
     

     If the error is still not resolved, please let me know the output to the following:

     grep remote_domains /etc/exim.conf
     

     Reply
2. 

   Kaushal Kishor Mahato on 2015-04-07 at 02:19

   If I want to bypass one or two domains, then how can I do that?

   Reply
   • 

     Visakh S on 2015-04-07 at 10:21

     Hi Kaushal,

     Thanks for the comment.

     Create a file /etc/allowdomains with ownership root:mail. Add the websites that you want to bypass to this file. Then add the below code in the Exim advanced editor using the Add additional configuration setting feature

     domainlist allow_domains = lsearch;/etc/allowdomains.

     Then use the below ACLs:

     1. Blocking all un-authenticated spoofed outbound emails

     Add the following code under acl_not_smtp :

     deny
     condition = ${if ! match_domain{${domain:${address:$h_From:}}}{+local_domains : +remote_domains : +allow_domains}}
     message = Sorry, you don't have \
     permission to send email from this server with a header that \
     states the email is from ${lc:${domain:${address:$h_from:}}}.
     accept
     

     2. Blocking all authenticated spoofed outbound emails

     deny
     authenticated     = *
     condition = ${if ! match_domain{${domain:${address:$h_From:}}}{+local_domains : +remote_domains : +allow_domains}}
     message = sorry, you don't have \
     permission to send email from this server with a header that \
     states the email is from ${lc:${domain:${address:$h_from:}}}.
     accept
     

     Reply
     • 

       Sergio on 2016-06-03 at 01:20

       Hi Visakh,
       thanks for sharing this.

       I have a doubt, you said:
       “Add the following code under acl_not_smtp :”

       But where under “acl not smtp”?
       There are a few boxes like:
       – custom_begin_outgoing_notsmtp_checkall
       – custom_begin_not_smtp
       Where I should write your code for the Authenticated Spoofed?

       Reply
       • 

         Prajith on 2016-07-04 at 08:55

         Sergio,

         It should be added under “custom_begin_outgoing_notsmtp_checkall”.

         Reply
3. 

   Tilak on 2015-05-13 at 08:32

   I have follow above steps successfully but when i add “domainlist remote_domains = lsearch;/etc/remotedomains”
   Line i am getting error.
   I run “grep remote_domains /etc/exim.conf” command and command output is below:
   ===============================
   # grep remote_domains /etc/exim.conf
   fail_remote_domains:
   ===============================
   Please guide me how to resolve the issue.

   Reply
   • 

     Prajith Kumar on 2015-10-30 at 09:11

     Hi Tilak,

     We attached the screenshots in the article so that you can configure it easily. Please check those.

     Reply
4. 

   Joshua on 2015-09-01 at 01:09

   Hello Visakh
   I have tried configuring with your instructions, but have ran into an issue, I have set the domainlist under additional configuration setting, when I go to configure acl_not_smtp (ensuring there is no spaces) I get an error for acl_smtp_mail and all variables below this up and until untrusted_set_Sender. The error message is:
   main option “message” unknown
   What am I doing wrong?

   Cheers,
   Joshua

   Reply
   • 

     Prajith Kumar on 2015-10-30 at 09:14

     Hi Joshua,

     I infer that you are adding the codes in wrong place. Please see the attached screenshot and try to configure again in correct place. If you are getting any errors, please paste it here so that I can assist you.

     Reply
5. 

   Michael on 2015-10-12 at 09:54

   Hi there,
   Trying to implement your “Blocking all authenticated spoofed outbound emails” option but after putting your code under “acl_smtp_data:” > “custom_begin_exiscanall” I get the error:

   error in ACL: unknown ACL condition/modifier in “{ !eqi{$authenticated_id} {${address:$header_From:}} }”

   Is it just me or is there something wrong with your if statement?

   Reply
   • 

     Prajith Kumar on 2015-10-30 at 09:16

     Hi Michael,

     There should be some space in between the code, which causing the issue. Please copy paste the above code in article and ensure to add it in correct place. Refer the screenshots in article

     Reply
6. 

   Hugo on 2015-10-13 at 14:32

   Hi Joshua,

   How can I add a mail whitelist for the part I? For example, I need that all outgoing mails authenticated, except if it comes from a specific email (root@hostname).

   Reply
7. 

   Prabhat Kumar on 2015-10-28 at 07:25

   Dear Vikas ji

   i have done as described in this link(https://bobcares.com/blog/blocking-spoofed-mails-going-out-of-your-cpanel-whm-web-hosting-server/) suggested by you. But failed getting some below error, Please help..

   vim /etc/exim.conf( added below lines on the top)

   domainlist remote_domains = lsearch;/etc/remotedomains

   i have added below code under the (acl_not_smtp = acl_not_smtp) this line.

   vim /etc/exim.conf

   deny
   condition = ${if ! match_domain{${domain:${address:$h_From:}}}{
   +local_domains : +remote_domains}}
   message = Sorry, you don’t have
   permission to send email from this server with a header that
   states the email is from ${lc:${domain:${address:$h_from:}}}.
   accept

   :wq (save and exit)

   service exim restart i got below error. please look into this

   service exim restart
   Shutting down exim: [ OK ]
   Shutting down spamd: [ OK ]
   Starting exim: 2015-10-28 12:30:51 Exim configuration error in line 56 of /etc/exim.conf:
   main option “deny” unknown
   [FAILED]
   0 processes (antirelayd) sent signal 9

   Reply
   • 

     Prajith Kumar on 2015-10-28 at 10:03

     Hi Prabhat,

     You are editing the /etc/exim.conf directly. The steps given are for editing Exim conf from WHM.

     You need to go to WHM >> EXIM CONFIGURATION MANAGER >> ADVANCED EDITOR , and find the ACLs section that starts with “acl_not_smtp:”

     To avoid this confusion, I’ve added screen shots in the article.

     Hope it helps. 🙂

     Reply
   • 

     Prajith Kumar on 2015-10-28 at 10:06

     Also note that the ACL rule is only 4 lines, that starts with the following strings:

     deny
     condition =
     message =
     accept

     So, if there are more more than 1 line in the condition or message directives, you should put a back-slash (\) at the end of the lines to avoid errors.

     Reply
8. 

   DJPRMF on 2015-10-28 at 15:14

   Should the “accept” be removed of that rules?

   That way he doesn’t prevent the other rules from take action (like the malware scanning)…

   Reply
   • 

     Prajith Kumar on 2015-10-29 at 10:16

     Hi Pedro,

     Yes, if you have malware scanning rules already present in your acl_not_smtp or acl_smtp_data ACL block, you should defer the accept to the last line, so that all rules applicable to reject the mail will be run before it reaches accept.

     Reply
     • 

       Josua on 2016-01-19 at 01:50

       Hey Prajith

       We recently encountered issues with this part:

       custom_begin_outgoing_smtp_checkall
       deny
       authenticated = *
       condition = ${if or { \
       { !eqi{$authenticated_id} {$sender_address} } \ { !eqi{$authenticated_id} {${address:$header_From:}} } \ } } message = Your FROM address ( $sender_address , $header_From ) must \ match your authenticated email user ( $authenticated_id ). \ Treating this as a spoofed email.
       accept

       It seems to break the SpamAssasin rules that come with cPanel.

       You do mention that the “accept” part has to be deferred – could you be a bit more specific?

       Would you simply delete it from this segment or?

       Reply
       • 

         AV on 2016-06-10 at 23:08

         Any answer?

         I also have the same issue, SpamAssassing doesn’t filter any incomming spam for any hosted account.

         Should I simply remove the “accept” word in both ACL rules?

         Reply
9. 

   Prabhat Kumar on 2015-10-29 at 08:14

   Hi,

   I have done successfully thank you so much.One another question is that how can i byepass some domains.
   i have tried which you metion in reply. But not working kindly suggest.

   Reply
   • 

     Prajith Kumar on 2015-10-29 at 09:41

     Hi Prabhat,

     The idea is to create one more list called allow_domains and add it to the ACL along with local_domains and remote_domains.

     Can you let me know what all steps you have already taken, and what error (if any) you are getting?

     Reply
10. 

    Prabhat Kumar on 2015-10-29 at 11:33

    Dear Prajith ji,
    i have done as below and no one error is coming. But allowdomains is not working

    domainlist remote_domains = lsearch;/etc/remotedomains
    domainlist allow_domains = lsearch;/etc/allowdomains

    i have addded below under (custome_begain_outgoing_notsmtp_checkall)

    deny
    condition = ${if ! match_domain{${domain:${address:$h_From:}}}{+local_domains : +remote_domains : +allow_domains}}
    message = Sorry, you don’t have
    permission to send email from this server with a header that \
    states the email is from ${lc:${domain:${address:$h_from:}}}.
    accept

    And now i have added below under (custom_begin_outgoing_smtp_checkall)

    deny
    authenticated = *
    condition = ${if ! match_domain{${domain:${address:$h_From:}}}{+local_domains : +remote_domains : +allow_domains}}
    message = sorry, you don’t have \
    permission to send email from this server with a header that \
    states the email is from ${lc:${domain:${address:$h_from:}}}.

    Reply
    • 

      Prajith Kumar on 2015-10-30 at 06:01

      Hi Prabhat,

      Can you please confirm the below:

      Did you create the file /etc/allowdomains and added the domain to be whitelisted in it? Please note that the file should have root:mail ownership.
      I just tested this and is working fine from my end

      If you have still issue can you please provide the output of following:
      —
      grep allow_domains /etc/exim.conf
      cat /etc/allowdomains
      —

      Reply
11. 

    Prabhat Kumar on 2015-10-30 at 06:38

    Dear Prajith ji,

    I have another issue with exim. any one can connect my server through telnet and able to send email in same account. How can We protect that one. see blow example.

    nishant@nishant-Lenovo-B40-80 ~ $ telnet kvit.in 25
    Trying 43.252.91.161…
    Connected to kvit.in.
    Escape character is ‘^]’.
    220-ns1.linux-hosting.in ESMTP Exim 4.86 #2 Fri, 30 Oct 2015 12:04:18 +0530
    220-We do not authorize the use of this system to transport unsolicited,
    220 and/or bulk e-mail.
    helo kvit.in
    250 ns1.linux-hosting.in Hello mail1.kvit.in [122.176.40.9]
    mail from: zimbra@kvit.in
    250 OK
    rcpt to: zimbra@kvit.in
    250 Accepted
    data
    354 Enter message, ending with “.” on a line by itself
    hi this is spoffed email.
    .
    250 OK id=1Zs3HR-0005JX-KU

    Reply
    • 

      Visakh S on 2015-10-30 at 08:50

      Hi Prabhat,

      Isn’t that expected? I just now tried telnet on your server, and looks like zimbra@kvit.in is a valid email account. So, it will accept a mail irrespective of what the FROM ID is.

      mail from:spammer@gmail.com
      250 OK
      rcpt to:prabhatk@kvit.in
      550 No such person at this address
      rcpt to:bibuiudsybf@kvit.in
      550 No such person at this address
      rcpt to:zimbra@kvit.in
      250 Accepted

      Wonder how this behavior is related to spoofing. Do you think this could be connected to outbound mail spoofing?

      Reply
12. 

    Prabhat Kumar on 2015-11-02 at 07:00

    Hi, Vikas ji,

    If any one knows my email account can send email to my Bose behalf of me. You know it is very easy to find anyone email id in organization. See below example.

    nishant@nishant-Lenovo-B40-80 ~ $ telnet kvit.in 25
    Trying 43.252.91.161…
    Connected to kvit.in.
    Escape character is ‘^]’.

    220-ns1.linux-hosting.in ESMTP Exim 4.86 #2 Mon, 02 Nov 2015 12:25:13 +0530
    220-We do not authorize the use of this system to transport unsolicited,
    220 and/or bulk e-mail.
    500 unrecognized command
    helo kvit.in
    250 ns1.linux-hosting.in Hello mail1.kvit.in [122.176.40.9]
    mail from: prabhat@kvit.in
    250 OK
    rcpt to: vikas@kvit.in

    250 Accepted
    data
    354 Enter message, ending with “.” on a line by itself
    hi, I am going to resgine your company
    .
    250 OK id=1Zt92L-0005wm-Sq

    Reply
    • 

      Visakh S on 2015-11-05 at 13:13

      Hi Prabhat,

      The easiest way to deal with this is to enable SPF checking. In that way, a server that is not authorized to send mails using kvit.in will not be able to spoof your email ID.

      See below for more details:
      https://bobcares.com/blog/avoid-spamming-using-anti-spamming-dns-records/

      Reply
13. 

    Prabhat Kumar on 2015-11-06 at 14:18

    Dear Vikas ji,

    Thanks for you reply. These day most of mails server don’t care about SPF record and DKIM. So we can set this policy. if is there any other solution kindly tell use.

    Reply
    • 

      Visakh S on 2015-11-06 at 15:00

      Hi Prabhat,

      If your Exim server is enabled with SPF checking, that’s all you need. The filtering happens at your server’s end.

      Reply
14. 

    Kaydet.NET on 2016-06-04 at 00:04

    Hi,

    Great post. I applied all and hoping to get breath from spammers 🙂

    Everything works fine However i found something missing in the rule;

    if user uses the email id that is same with cpanel username which is created when the cpanel account created, he’s still treated as spammer and receive the notification in below code;

    deny
    authenticated = *
    condition = ${if or { \
    { !eqi{$authenticated_id} {$sender_address} } \
    { !eqi{$authenticated_id} {${address:$header_From:}} } \
    } }
    message = Your FROM address ( $sender_address , $header_From ) must \
    match your authenticated email user ( $authenticated_id ). \
    Treating this as a spoofed email.
    accept

    Is it possible you can share with us what more to add in order to resolve this problem?

    I got this error when i use cpanel user’s accessing via webmail, didn’t try outlook setup.

    Reply
15. 

    Prajith on 2016-07-04 at 09:06

    IMPORTANT Points to keep in mind

    POP before SMTP won’t work with this setting. You will have to ask your customers to use the option – “My Server Requires Authentication” in the SMTP settings of their email client.
    Username in the format user+domain.com will not work. They have to use user@domain.com instead.
    Email send from default email account won’t work.

    You can override the above problems by using the following entry in ACL under acl_smtp_data instead of the above one:

    deny
    authenticated = *
    condition = ${if !match_address{${address:$h_From:}}{+whitelist_senders}}
    condition = ${if !match_domain{${domain:${address:$h_from:}}}{+remote_domains}}
    log_message = Seems like a spoofing attempt. Please check now.
    message = sorry, you don’t have the permission to send email from this server with a header that\
    states the email is from ${lc:${address:$h_from:}}.

    accept

    You may add the user@hostname accounts to a file /etc/emailaccounts or so (create any file). And you need to add the following entry using the Add additional configuration setting feature:

    addresslist whitelist_senders = ${if exists{/etc/emailaccounts} {lsearch;/etc/emailaccounts} fail}

    You can set up a script and run it as cron to populate the file automatically.

    Reply
16. 

    Rhumjhum on 2016-08-05 at 16:48

    Hello,

    What about compromised email accounts as on many many times user account gets compromised and hacker send 1000+ the spam from there.

    Reply