如何彻底阻止中继外来域邮件（附日志）

hjohn

我的MDaemon中“安全”选项里已经设置了禁止中止外来域邮件，可是仍然发现有非本公司域的邮件冒充本公司某个邮箱往外发，这种情况是怎么回事？请看以下日志：（其中XXX.XXX.XXX.XXX是公司IP地址，XXXX.com是公司域名）



Sat 2010-05-29 05:23:33: Session 1014; child 1
Sat 2010-05-29 05:23:32: Parsing Message <e:\mdaemon\queues\remote\pd35000893991.msg>
Sat 2010-05-29 05:23:32: From: flr@ioty.net
Sat 2010-05-29 05:23:32: To: zxf_1969@163.com
Sat 2010-05-29 05:23:32: Subject: =?GB2312?B?zOG5qdfu0MKzycGitcTG89K1w/u1pQ==?=
Sat 2010-05-29 05:23:32: Message-ID: <20100529053653.07D4F2B913@sxdiptz.net>
Sat 2010-05-29 05:23:32: [163.com]的 MX-record 解析已在进行(DNS 服务: 202.106.196.115)...
Sat 2010-05-29 05:23:32: *  P=050 D=163.com TTL=(51) MX=[163mx00.mxmail.netease.com]
Sat 2010-05-29 05:23:32: *  P=010 D=163.com TTL=(51) MX=[163mx04.mxmail.netease.com]
Sat 2010-05-29 05:23:32: *  P=010 D=163.com TTL=(51) MX=[163mx03.mxmail.netease.com]
Sat 2010-05-29 05:23:32: *  P=010 D=163.com TTL=(51) MX=[163mx02.mxmail.netease.com]
Sat 2010-05-29 05:23:32: *  P=010 D=163.com TTL=(51) MX=[163mx01.mxmail.netease.com]
Sat 2010-05-29 05:23:32: Attempting MX: P=010 D=163.com TTL=(51) MX=[163mx01.mxmail.netease.com]
Sat 2010-05-29 05:23:32: 正在试图 SMTP 连接到 [163mx01.mxmail.netease.com : 25]
Sat 2010-05-29 05:23:32: [163mx01.mxmail.netease.com]A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Sat 2010-05-29 05:23:32: D=163mx01.mxmail.netease.com TTL=(3) A=[220.181.12.53]
Sat 2010-05-29 05:23:32: 正在试图 SMTP 连接到 [220.181.12.53 : 25]
Sat 2010-05-29 05:23:32: 等候 socket 连接...
Sat 2010-05-29 05:23:32: Socket 连接建立(XXX.XXX.XXX.XXX : 4398 -> 220.181.12.53 : 25)
Sat 2010-05-29 05:23:32: 等候协议初始化...
Sat 2010-05-29 05:23:33: <-- 220 163.com Anti-spam GT for Coremail System (163com[20090903])
Sat 2010-05-29 05:23:33: --> EHLO XXXX.com
Sat 2010-05-29 05:23:33: <-- 250-mail
Sat 2010-05-29 05:23:33: <-- 250-PIPELINING
Sat 2010-05-29 05:23:33: <-- 250-AUTH LOGIN PLAIN
Sat 2010-05-29 05:23:33: <-- 250-AUTH=LOGIN PLAIN
Sat 2010-05-29 05:23:33: <-- 250-coremail 1Uxr2xKj7kG0xkI17xGrU7I0s8FY2U3Uj8Cz28x1UUUUU7Ic2I0Y2UrVefvjUCa0xDrUUUUj
Sat 2010-05-29 05:23:33: <-- 250 8BITMIME
Sat 2010-05-29 05:23:33: --> MAIL From:<abc@XXXX.com>
Sat 2010-05-29 05:23:33: <-- 250 Mail OK
Sat 2010-05-29 05:23:33: --> RCPT To:<zxf_1969@163.com>
Sat 2010-05-29 05:23:33: <-- 250 Mail OK
Sat 2010-05-29 05:23:33: --> DATA
Sat 2010-05-29 05:23:33: <-- 354 End data with <CR><LF>.<CR><LF>
Sat 2010-05-29 05:23:33: 正在发送 <e:\mdaemon\queues\remote\pd35000893991.msg> 到 [220.181.12.53]
Sat 2010-05-29 05:23:33: 发送完成。
Sat 2010-05-29 05:23:33: <-- 250 Mail OK queued as mx3,NcCowKD7b_QFNwBM061rAA--.1756S2 1275082502
Sat 2010-05-29 05:23:33: --> QUIT
Sat 2010-05-29 05:23:33: <-- 221 Bye
Sat 2010-05-29 05:23:33: SMTP 连接成功完成(字节入/出: 378/3830)
Sat 2010-05-29 05:23:33: ----------



Sat 2010-05-29 08:15:17: Session 1138; child 1
Sat 2010-05-29 08:15:17: Parsing Message <e:\mdaemon\queues\remote\pd35000893993.msg>
Sat 2010-05-29 08:15:17: From: ciotzfkq@wchntyd.com.tw
Sat 2010-05-29 08:15:17: To: jianhua_91@126.com
Sat 2010-05-29 08:15:17: Subject: =?GB2312?B?zqrE48zhuakwOS0xMMTq1+7QwrmkyczXorLhtcS5q8u+w/vCvA==?=
Sat 2010-05-29 08:15:17: Message-ID: <20100529082841.07D4F2B468@sydjpuz.com>
Sat 2010-05-29 08:15:17: [126.com]的 MX-record 解析已在进行(DNS 服务: 202.106.196.115)...
Sat 2010-05-29 08:15:17: *  P=050 D=126.com TTL=(59) MX=[126mx00.mxmail.netease.com]
Sat 2010-05-29 08:15:17: *  P=010 D=126.com TTL=(59) MX=[126mx02.mxmail.netease.com]
Sat 2010-05-29 08:15:17: *  P=010 D=126.com TTL=(59) MX=[126mx01.mxmail.netease.com]
Sat 2010-05-29 08:15:17: Attempting MX: P=010 D=126.com TTL=(59) MX=[126mx01.mxmail.netease.com]
Sat 2010-05-29 08:15:17: 正在试图 SMTP 连接到 [126mx01.mxmail.netease.com : 25]
Sat 2010-05-29 08:15:17: [126mx01.mxmail.netease.com]A-record 解析已在进行(DNS 服务器: 202.106.196.115)...
Sat 2010-05-29 08:15:17: D=126mx01.mxmail.netease.com TTL=(6) A=[220.181.15.134]
Sat 2010-05-29 08:15:17: 正在试图 SMTP 连接到 [220.181.15.134 : 25]
Sat 2010-05-29 08:15:17: 等候 socket 连接...
Sat 2010-05-29 08:15:17: Socket 连接建立(XXX.XXX.XXX.XXX : 1059 -> 220.181.15.134 : 25)
Sat 2010-05-29 08:15:17: 等候协议初始化...
Sat 2010-05-29 08:15:17: <-- 220 126.com Anti-spam GT for Coremail System (126com[20090903])
Sat 2010-05-29 08:15:17: --> EHLO XXXX.com
Sat 2010-05-29 08:15:17: <-- 250-mail
Sat 2010-05-29 08:15:17: <-- 250-PIPELINING
Sat 2010-05-29 08:15:17: <-- 250-AUTH LOGIN PLAIN
Sat 2010-05-29 08:15:17: <-- 250-AUTH=LOGIN PLAIN
Sat 2010-05-29 08:15:17: <-- 250-coremail 1Uxr2xKj7kG0xkI17xGrU7I0s8FY2U3Uj8Cz28x1UUUUU7Ic2I0Y2UF7w4PGUCa0xDrUUUUj
Sat 2010-05-29 08:15:17: <-- 250 8BITMIME
Sat 2010-05-29 08:15:17: --> MAIL From:<tech@XXXX.com>
Sat 2010-05-29 08:15:17: <-- 250 Mail OK
Sat 2010-05-29 08:15:17: --> RCPT To:<jianhua_91@126.com>
Sat 2010-05-29 08:15:17: <-- 250 Mail OK
Sat 2010-05-29 08:15:17: --> DATA
Sat 2010-05-29 08:15:17: <-- 354 End data with <CR><LF>.<CR><LF>
Sat 2010-05-29 08:15:17: 正在发送 <e:\mdaemon\queues\remote\pd35000893993.msg> 到 [220.181.15.134]
Sat 2010-05-29 08:15:17: 发送完成。
Sat 2010-05-29 08:15:17: <-- 250 Mail OK queued as mx4,IsmowKCb3_FEXwBMx6ogAg--.166S2 1275092804
Sat 2010-05-29 08:15:17: --> QUIT
Sat 2010-05-29 08:15:17: <-- 221 Bye
Sat 2010-05-29 08:15:17: SMTP 连接成功完成(字节入/出: 377/3854)
Sat 2010-05-29 08:15:17: ----------

arthorzhou

1. 设定发送邮件必须经过密码验证. (当邮件来自本地帐号, 总是需要验证)
2. 注意禁止中聚的信任主机IP...
3. 最好设定SPF可以解决这个问题

mynetway

严格的SPF就可阻挡
要-all不要～all