Hello everyone, I have a question regarding the SMTP Protection. We have two mailservers. A) internal MS Exchange and B) external exim4. The exim4 is only used to temporary store ingoing mails if our internal mailserver is down. So B relays all emails to A through the Sophos. B does not do spam checks or else, it just relays everything for our internal email to A and drop everything else. Problem: in the last time hackers try to infiltrate us with ransomware, pretending they got an attached scan.doc from scanner@ourdomain.tld. Here is an email header: Received: from mail.ourdomain.tld (192.168.1.1) by internal-mail.ourdomain.tld (192.168.1.45) with Microsoft SMTP Server (TLS) id 14.2.347.0; Thu, 11 Feb 2016 12:00:40 +0100 Received: from external.hosted-server.tld ([6.6.6.42]:37011) by mail.ourdomain.tld with esmtps (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1aToz7-0005E2-0M for info@ourdomain.tld; Thu, 11 Feb 2016 12:00:29 +0100 Received: from [123.231.117.146] by external.hosted-server.tld with esmtp (Exim 4.82) (envelope-from ) id 1aToz5-000101-T3 for info@ourdomain.tld; Thu, 11 Feb 2016 12:00:28 +0100 From: To: Subject: =?ISO-8859-1?B?U2NhbiBmcm9tIEtNMTY1MA==?= Date: Thu, 11 Feb 2016 16:30:18 +0530 Message-ID: MIME-Version: 1.0 X-Mailer: NetWorkScanner Mail System Version 1.1 Content-Type: multipart/mixed; boundary="------------VGh1LCAyMSBKYW4gMjAxNiAxNjo1MTo0NSArMDAwMA==" Return-Path: scanner@ourdomain.tld X-MS-Exchange-Organization-AuthSource: internal-mail.ourdomain.tld X-MS-Exchange-Organization-AuthAs: Anonymous X-Auto-Response-Suppress: DR, OOF, AutoReply My idea to stop mails like them is to auto quarantine ingoing mails from *@ourdomain.tld because only our internal MS Exchange server should send mails from *@ourdomain.tld. Question: is this a good way o solve this problem? Are there other (better?) ways to solve this problem? Best regards Chris
↧