incoming phishing email block

[digiweb]

How can I block fake mails with the same sender and recipient parts.

ex:
from: test@abc.com
to: test@abc.com
auth-email: nick@tester.com

actually the account is logged in as nick@tester.com but it tries to send mail like test@abc.com.

Although the "Use SPF" feature is active, I receive a lot of such mails.

 

[dcsapak]

if you control abc.com, you can create a dmarc policy that requires a valid dkim signature which includes the from header
aside from that you cannot really verify if the from header is legit or not (since it's just a header field)

 

[digiweb]

according to the example I gave above;

abc.com and tester.com are not on the same server. The sender logs in to tester.com account and writes abc.com in the sender section. There should be a control in the form of "If it says abc.com in the sender section but this mail does not come from the abc.com server".

 

[dcsapak]

abc.com and tester.com are not on the same server. The sender logs in to tester.com account and writes abc.com in the sender section. There should be a control in the form of "If it says abc.com in the sender section but this mail does not come from the abc.com server".

sender (i guess you mean the envelope sender) is checked by spf, the from header is checked by dkim, dmarc policy regulates how strict these are and if a recipient should check these things (and possibly discard the mail if it doesn't match)

 

[digiweb]

A sample header is as follows.

Received: from 209.85.208.45 (EHLO mail-ed1-f45.google.com)
 by 10.226.14.96 with SMTPs
 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);
 Tue, 17 Oct 2023 12:07:12 +0000
Received: by mail-ed1-f45.google.com with SMTP id 4fb4d7f45d1cf-53f3609550bso119247a12.1
        for <test@abc.com>; Tue, 17 Oct 2023 05:07:11 -0700 (PDT)
Received: from server.abc.com
    by server.abc.com with LMTP
    id 4Gl6LDzqLmVmNwAAVyjlSw
    (envelope-from <>)
    for <test@abc.com>; Tue, 17 Oct 2023 23:10:36 +0300
Received: from [103.186.116.48] (helo=o2.em4.remarkety.com)
    by server.abc.com with esmtp (Exim 4.96.1-7-g79877b70e)
    id 1qsqOi-00057S-1b
    for test@abc.com;
    Tue, 17 Oct 2023 23:10:36 +0300
From: "SurgeMastercard" <test@abc.com>
To: "SurgeMastercard" <test@abc.com>
Subject: Get Your New Surge Mastercard!
Date: Wed, 18 Oct 2023 00:09:07 +0300
Message-ID: <CABi3KtzEiBp=sfH649270252758818942xv9cArL6YyN60SnEmlVp6QDGs2Hsqrig@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_002D_01DA01A9.E7761FB0"
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AQFxMFdcU1BsgGGCdkGM5Q8qzqOOfQ==