How do I allow 'legitimately' spoofed email and block all other spoofed email?

This article applies to:

• Trustwave MailMarshal (SEG)

Question:

• How do I allow legitimately spoofed email and block all other spoofed email?
• How do I selectively block spoofed email?
• How do I identify valid spoofed email?

Details:

MailMarshal uses the following criteria to identify and block all spoofed email, legitimate and otherwise:

• Inbound email addressed from *@yourdomain.com.
• Did not originate from your mail server.

In some cases you may want to allow email messages generated elsewhere to pass through. For instance, email distribution list groups often send email as the user. 

Procedure:

To allow legitimate email to pass, you can add exclusions to the Block Spoofed Messages rule.

1. Create a TextCensor script named Spoofing Exclusions.

   Sample TextCensor script:

   

   The following script, specified in the Edit TextCesor Script dialog box, above, does not block spoofed email with fedex, cnn.com, msnbc, or webex in the message subject:
   
   "NOT (fedex OR cnn.com OR msnbc OR webex)"

   Notes:

   This script assumes that the text you are matching is in the message subject. It does NOT check the sender email address. Many distribution lists provide unique identifying text in the subject. Matching on sender email addresses is very likely to allow unwanted spoofed items.
   
   Add any additional keywords to the existing entry - NOT as a new TextCensor item.  For instance the line could read:
   
   "NOT (fedex OR cnn.com OR msnbc OR webex OR yahoo)"

    

2. In the Block Spoofed Messages rule, add this script as a condition:
   

   When a message arrives
   Where message is incoming
   Where message triggers text censor script(s) 'Spoofing Exclusions'
    And where message spoofing analysis is based on 'anti-relay'
   Send a 'Spoofed Message In' notification message
       And write log message(s) with 'Spoofed Message Inbound'
       And move the message to 'Spoofed Messages'

   
   Note: The logic of this rule is that the script triggers when the subject DOES NOT contain the exclusions.
3. Commit configuration changes to activate this exception script.

Notes:

• Be as specific as possible in creating the TextCensor script. Base the exclusions on specific examples of email that you want to allow. For instance, distribution lists often include the list name in the subject.
• If the subject of the messages does not include any unique text, you can normally identify unique text in other message headers.
  • Use the message viewer in the MailMarshal Console to review headers of your target emails.
  • Create a TextCensor script that checks the headers only (NOT the subject or sender).
  • Include the text you have identified in the TextCensor item.
• Be aware that spam senders attempt to exploit spoofing. The recipient domain (your domain) and common domains such as yahoo and cnn are often spoofed by spam senders. Allowing any spoofed email is likely to increase the amount of unwanted mail your server accepts.

This article was previously published as:

NETIQKB34945