How do I allow 'legitimately' spoofed email and block all other spoofed email?

This article applies to:

• Trustwave MailMarshal (SEG)

Question:

• How do I allow "legitimately spoofed" email and block all other spoofed email?
• How do I selectively block spoofed email?
• How do I identify valid spoofed email?

Details:

MailMarshal uses the following criteria to identify and block messages considered "spoofed":

• Inbound email addressed from any of your local domains
• Did not originate from your mail server.

In some cases you may want to allow email messages generated elsewhere to pass through. For instance, email distribution list groups often send email as the user. 

Procedure:

To allow legitimate email to pass, you can add exclusions to the Block Spoofed Messages rule.

1. Edit the TextCensor script named Spoofing Exclusions (in the Management Interface > Policy Elements > TextCensor Scripts).
   • This script is present by default in current versions of MailMarshal. If it is not present in your installation, create it.
     
     

   • The expression specified in the image above will exclude messages with fedex, cnn.com, mysever1 or myserver2 in the message headers:
     
     "NOT (fedex OR cnn.com OR myserver1 OR myserver2)"

   • This script assumes that the text you are matching is in the message headers. You can consider limiting the check to the subject only.

   • Add any additional keywords to the existing entry - NOT as a new TextCensor item.  For instance the line could read:

   • "NOT (fedex OR cnn.com OR msnbc OR myserver1 or externalserver2)"

2. In the Block Spoofed Messages rule, you should already see this script included as a condition - if not, then add it:
   

   When a message arrives
   Where message is incoming
   Where message triggers text censor script(s) 'Spoofing Exclusions'
    And where message spoofing analysis is based on 'anti-relay'
   Send a 'Spoofed Message In' notification message
   And move the message to 'Spoofed' and categorize as  'Spam' 
   With release action 'skip to next policy group' 

   Note: The logic of this rule is that the script triggers when the headers DO NOT contain the exclusions.
3. Commit configuration changes.

Notes:

• Be as specific as possible in creating the TextCensor script. Base the exclusions on specific examples of email that you want to allow. For instance, distribution lists often include the list name in the subject.
• If the subject of the messages does not include any unique text, you can normally identify unique text in other message headers.
  • Use the message viewer in the MailMarshal Console to review headers of your target emails.
  • Create a TextCensor script that checks the headers only (NOT the subject or sender).
  • Include the text you have identified in the TextCensor item.
• Be aware that spam senders attempt to exploit spoofing. The recipient domain (your domain) and common domains such as cnn are often spoofed by spam senders. Allowing any spoofed email is likely to increase the amount of unwanted mail your server accepts.

This article was previously published as:

NETIQKB34945