Flooded with emails to root -- URGG

[Chris Pratt]

On Sep 25, 2008, at 9:34 AM, David Southwell wrote:

> Hi
>
> I am running postfix.
>
> Am receiving a flood of  emails that appear to emanate from Servers  
> who have
> received spam that has masqueraded root at mydomain as the email source.
>
> Could anyone please suggest the best way of dealing with these.  
> Please bear in
> mind I am not all that familiar with postfix so if anyone feels  
> treating me
> like an idiot and spoonfeeding the actual command s to use I would  
> be most
> appreciative <chuckles>
>

I have no idea what a command would be to stop receipt. Cutting off the
original generation of the emails being spoofed is more to the point.

You may want to look at SPF (openspf.org). If your domain is listed  
with an
spf entry in DNS, you become less tempting as a domain to spoof. Over
time, it will all but cease. Once you've created an SPF DNS record, many
servers receiving mail spoofed for your domain will begin to drop it  
rather
than backscatter emails back to your server.

You should study the information on their site but in a nutshell, you  
create
a TXT record in DNS that lists your servers IP as the only valid  
machine to
send mail for your domain. This tells the others to drop emails from  
other
IPs using your domain. It's relatively effective and painless.