zombie attack target email account

Started by djfininho, May 25, 2023, 06:48:30 PM

Previous topic - Next topic

djfininho

Help please

a single email account is receiving around 30 to 50 emails from Undelivered Mail Returned to Sender
FROM: <MAILER-DAEMON@server.xxxxxxxxxxxx.xxx.xxx> TO: <xxxxxxxxx@xxxxxxxxxxxxxxx.xxxx.xxxx>
from different recipients.
but the email is not being used for sending, I believe it is a zombie attack, how to prevent sending emails using your email outside the server?

https://suporte.hostgator.com.br/hc/pt-br/articles/360015544414-O-que-é-um-ataque-de-e-mail-spoofing-

overseer

Are your SPF and DMARC DNS records set up properly to restrict sending to your own domain and server IP address?

djfininho

Quote from: overseer on May 26, 2023, 01:00:08 AM
Are your SPF and DMARC DNS records set up properly to restrict sending to your own domain and server IP address?

hello overseer

Yes they are configured and validated

overseer

And have you hardened your postfix installation to prevent relaying? Pay particular attention to the $mynetworks and $relay_domains directives. Do you have UCE controls properly implemented in Postfix? Don't trust the defaults -- they are just a starting point. You should be much more restrictive than what CWP provides as an initial basis.

djfininho

Quote from: overseer on May 27, 2023, 05:17:15 PM
And have you hardened your postfix installation to prevent relaying? Pay particular attention to the $mynetworks and $relay_domains directives. Do you have UCE controls properly implemented in Postfix? Don't trust the defaults -- they are just a starting point. You should be much more restrictive than what CWP provides as an initial basis.


Hello overseer.

Yes yes, and I am also monitoring more often.

Thank you for your attention.