SPAM needs to filter: to: does not contain a local receiver

[cremesk]

Hi guys,
i'm currently struggling with a lot of spam and I need your help to filter it.

the problem is i received some mails with non-local receiver..

my local domain is: secnux.net and freifunk-dresden.de

for example:
vorstand@freifunk-dresden.de received messages with an To: <leithner@freesulf.de> how can i stop this?

Return-Path: <isjoxjd@nokelanser.hz.cz>
Received: from mail.secnux.net
	by mail.secnux.net (Dovecot) with LMTP id 70SNBFumh2MjPgAA6gntNQ
	; Wed, 30 Nov 2022 18:52:11 +0000
Received: from localhost (localhost [127.0.0.1])
	by mail.secnux.net (Postfix) with ESMTP id D58577203B3
	for <vorstand@freifunk-dresden.de>; Wed, 30 Nov 2022 18:52:10 +0000 (UTC)
Authentication-Results: mail.secnux.net;
	dkim=pass (1024-bit key; unprotected) header.d=nokelanser.hz.cz header.i=@nokelanser.hz.cz header.b="pA3R5Uoq";
	dkim-atps=neutral
X-Virus-Scanned: Debian amavisd-new at mail.secnux.net
X-Spam-Flag: NO
X-Spam-Score: 4.605
X-Spam-Level: ****
X-Spam-Status: No, score=4.605 tagged_above=2 required=4.71
	tests=[BAYES_00=-1.9, DIGEST_MULTIPLE=0.293, DKIM_SIGNED=0.1,
	DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546,
	HTML_IMAGE_RATIO_04=0.556, HTML_MESSAGE=0.001, PYZOR_CHECK=1.392,
	RAZOR2_CF_RANGE_51_100=1.886, RAZOR2_CHECK=0.922, SPF_PASS=-0.001,
	T_TVD_MIME_EPI=0.01] autolearn=no autolearn_force=no
Received: from mail.secnux.net ([127.0.0.1])
	by localhost (mail.secnux.net [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 2V2KEGT0CW5h for <vorstand@freifunk-dresden.de>;
	Wed, 30 Nov 2022 18:52:08 +0000 (UTC)
Received: from mx.nokelanser.hz.cz (mx.nokelanser.hz.cz [46.165.253.14])
	by mail.secnux.net (Postfix) with ESMTP
	for <vorstand@freifunk-dresden.de>; Wed, 30 Nov 2022 18:52:08 +0000 (UTC)
Received: from nokelanser.hz.cz (rorexov.one [194.61.0.57])
	by mx.nokelanser.hz.cz (Postfix) with ESMTPA id 2D5083D09;
	Wed, 30 Nov 2022 20:51:58 +0200 (EET)
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=nokelanser.hz.cz;
	s=key2; h=DomainKey-Signature:Message-ID:From:To:Subject:Date:
	MIME-Version:Content-Type; bh=paWwyNDpzTdaUASb+Hd6ySPN34J1VT+JXk
	ubTU8VXIY=; b=pA3R5Uoqoujknbn0K4Cj6wM6ZfHaZ303pFSuYk0cfh7BZJFMdW
	ofIr0ddu5OIz19lr/fyHAP70bLBnYdi7mfjIUljmyFYiSoTirizP0R3d1le8hMRp
	zJQI0F9uqj4I0+feUWa0hVvUdkWMXdgRxI5CDQyMo9sdTkj1YayCI67Uc=
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple;
	s=key1; d=nokelanser.hz.cz;
	h=Message-ID:From:To:Subject:Date:MIME-Version:Content-Type;
	b=sH5b6NhdJSiQFSn6qzTt/J4Yy9OerF9IobsN/nYdLXwUsvOASXwaPY3PcLzR66ZiCkyANGtfAtcJuogemjPwIiA0vfP9FM8Z5P8hFTQgSvoxDJfgOvROjJRNT9c/3+qa5rYyEAzZ8JJkH459COx3gG13gejME3PiDYk43fWU2Go=;
Message-ID: <4161256770200031448610800562505815745023@nokelanser.hz.cz>
From: "Gluconol" <isjoxjd@nokelanser.hz.cz>
To: <leithner@freesulf.de>
Subject: =?utf-8?B?R2x1Y29ub2wg4oCTIERvcHBlbHNjaGxhZyBhdWYgZGVuIERpYWJldGVz?=
Date: Wed, 30 Nov 2022 19:52:49 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
	type="multipart/alternative";
	boundary="----=_NextPart_000_0006_01D904F3.9BFEC770"

This is a multi-part message in MIME format.

maybe postfix needs a

relay_recipient_maps = ?!

or something?

Thanks for any help or ideas!

[tonioo]

I don't know if there a simple way to check that but I don't think relay recipient maps would help here.
The problem is most of filtering is done at the ENVELOPE level, which is valid in your case. But we can see that the To: header is clearly different, so I'd say that a custom filter could do the trick (ie. check if MAIL FROM and To header are equals).

[cremesk]

i once looked on the internet and tried to understand.. would this be a possibility?

nano /etc/postfix/main.cf

# end of file
header_checks = regexp:/etc/postfix/header_checks

nano /etc/postfix/header_checks

/^To:.*<(.*)@(.*)>/     /^From:.*<\1@(.*)>/     REJECT Mismatch between From and To addresses

[cremesk]

hmm.. looks like it doesn't works.. i got another spam mail like:

Return-Path: <ebjumlf@qintersak.tattoo>
Received: from mail.secnux.net
	by mail.secnux.net (Dovecot) with LMTP id ip9eN5/9K2RjTwAA6gntNQ
	; Tue, 04 Apr 2023 10:36:15 +0000
Received: from localhost (localhost [127.0.0.1])
	by mail.secnux.net (Postfix) with ESMTP id C4B557200C8
	for <freifunk@freifunk-dresden.de>; Tue,  4 Apr 2023 10:36:15 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at mail.secnux.net
X-Spam-Flag: NO
X-Spam-Score: 2.371
X-Spam-Level: **
X-Spam-Status: No, score=2.371 tagged_above=2 required=4.71
	tests=[BAYES_00=-1.9, HTML_IMAGE_ONLY_24=1.618,
	HTML_IMAGE_RATIO_08=0.001, HTML_MESSAGE=0.001, PYZOR_CHECK=1.392,
	SPF_PASS=-0.001, T_TVD_MIME_EPI=0.01, URIBL_ABUSE_SURBL=1.25]
	autolearn=no autolearn_force=no
Received: from mail.secnux.net ([127.0.0.1])
	by localhost (mail.secnux.net [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id PNNVZSufhbZ0 for <freifunk@freifunk-dresden.de>;
	Tue,  4 Apr 2023 10:36:14 +0000 (UTC)
Received: from mail.qintersak.tattoo (mail.qintersak.tattoo [85.25.194.150])
	by mail.secnux.net (Postfix) with ESMTP
	for <freifunk@freifunk-dresden.de>; Tue,  4 Apr 2023 10:36:14 +0000 (UTC)
Received: from qintersak.tattoo (229004-5.vm.clodoserver.ru [62.76.188.81])
	by mail.qintersak.tattoo (Postfix) with ESMTPA id A48381818DD8A;
	Tue,  4 Apr 2023 13:36:10 +0300 (EEST)
Message-ID: <7276546170584264584223276562344520643617@qintersak.tattoo>
From: "Proktologie" <ebjumlf@qintersak.tattoo>
To: <kobald@freesulf.de>
Subject: Effektive Behandlung von Hamorrhoiden in jedem Stadium
Date: Tue, 04 Apr 2023 13:36:14 +0300
MIME-Version: 1.0
Content-Type: multipart/related;
	type="multipart/alternative";
	boundary="----=_NextPart_000_0006_01D966F8.4D356DD0"

This is a multi-part message in MIME format.

[cremesk]

hi thank you for your reply. do you know how this could be implemented in concrete terms? Unfortunately, I'm an absolute noob when it comes to spam filters and I don't even know where to start to fix the problem. :/
(Maybe you could also integrate this directly into modoboa. i think that many would like to get rid of this spam.)