Getting SPAM from myself

Support
1

NethServer Version: 7
Module: core

I’m getting SPAM from myself (fake source FROM).

I’m trying really hard to avoid ANYONE to pretend to be our team to send e-mails.

Now a director get an e-mail from herself written in English and she do not speak english!

Return-Path: <carolina@antinsect.com.br>
Received: from agulhao.antinsect.com.br
	by agulhao.antinsect.com.br with LMTP id +Oh6FxW8DGlEeQAAlXp8jQ
	; Thu, 06 Nov 2025 12:17:41 -0300
Received: from antinsect.com.br (unknown [62.60.130.76])
	by agulhao.antinsect.com.br (Postfix) with ESMTP id 1E1DA249F622
	for <carolina@antinsect.com.br>; Thu,  6 Nov 2025 12:17:38 -0300 (-03)
From: antinsect.com.br <carolina@antinsect.com.br>
To: carolina@antinsect.com.br
Subject: Compulsory Account Update Required. Failure to complete this update will result in your account being temporarily blocked
Date: 06 Nov 2025 07:17:37 -0800
Message-ID: <20251106071736.2471801613645547@antinsect.com.br>
MIME-Version: 1.0
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Rspamd-Server: agulhao.antinsect.com.br
X-Rspamd-Queue-Id: 1E1DA249F622
X-Spamd-Result: default: False [0.00 / 20.00];
	ASN(0.00)[asn:215930, ipnet:62.60.130.0/24, country:RS];
	FROM_SUBDOMAINS_WHITELIST(0.00)[antinsect.com.br]
X-Rspamd-Pre-Result: action=no action;
	module=multimap;
	Matched map: FROM_SUBDOMAINS_WHITELIST

I’ve searched for ASN 215930:

Autonomous System Number (ASN) 215930 is registered to CIPHER OPERATIONS DOO BEOGRAD.

Key details include:

  • Organization: CIPHER OPERATIONS DOO BEOGRAD - NOVI BEOGRAD

  • Location: Belgrade, Serbia (RS)

  • Registry: RIPE (Réseaux IP Européens)

  • Type: Business

  • Allocation Date: November 28, 2023

I’d like to understand WHAT I need to do to avoid ANYONE to send e-mail pretending to be our team.

I have SPF, DKIM, … all enabled… and I’d like to accept e-mail from our team JUST when is signed/authenticated with our domain account.

Regards,

Jáder

2

It seems you have whitelisted the domain, so it’s not checked further by rspamd. Please try to remove it from the whitelist.

EDIT:

DMARC also helps, see also email_protection_resources [NethServer & NethSecurity]

3

Does Nethserver accept mail with from addresses from its own domains on port 25 without authentication?

If yes, this could cause such spam with faked sender addresses.

4

That was my main concern… but for now I’ve removed it from allow list (whitelist).

Let’s try again… I’ll update you in a few days.