How to filter spam with To: header bogus address?

[discostu]

The Proxmox Mail Gateway seems to forward spam with an existing mail address/domain in the envelope ("info@ourdomain.blah"), but the To: field in the header is something completely bogus ore some other existing domain, for example "somebody@arcor.de"

Can this be filtered somehow? Or is there maybe a good reason not to filter that?

 

[jklocker]

This can be blocked by creating a custom SpamAssassin rule, something around the following lines should do the job:

header   LOCAL_ENV_TO_MISMATCH  ToCc !~ /\@ourdomain\.blah/i
describe LOCAL_ENV_TO_MISMATCH  No recipient from our domain in To/Cc headers
score    LOCAL_ENV_TO_MISMATCH  2.5

Please make sure to test this, the score might have to be adjusted as well.

Look at the following documentation for more information about custom SpamAssassin rules https://pmg.proxmox.com/pmg-docs/chapter-pmgconfig.html#_custom_spamassassin_configuration.

From what I've read, legitimate reasons not to block this include BCC and mailing lists.
I have no personal experience about this though, so maybe someone could add some more information regarding this.

 

[jixuuse]

A rule can be established in Postfix to prohibit emails sent from local domains, as emails sent between local domains will not be delivered to PMG.

vim header_checks
/^From\:.*\@xxxooo\.com/ REJECT Spam

postmap header_checks

vim main.cf
header_checks = regexp:/etc/postfix/header_checks