I am working on it for days now and still didnt find an answer.
I know that the default (and probably that what should be) Anyone can login to my server using port 25 and without authentication can send emails from: email@example.com to firstname.lastname@example.org.
I've read in many places and saw no solution for that and it's taken like it's something that is ok.
But this can be very risky (if adding reply-to header to malicious attacker) if someone from my company will get an email from another person in the company (fake) that will ask for some details.
Is there no way to block this?
I 've tried to play with main.cf a little bit but the only option to block that is if I block also every incoming emails from outside my server.
Anyone have an idea?
Here is main.cf restrictions that i have:
smtpd_relay_restrictions = permit_sasl_authenticated defer_unauth_destination
smtpd_sender_restrictions = reject_unauth_pipelining, reject_non_fqdn_sender, reject_unknown_sender_domain, check_sender_access hash:/var/spool/postfix/plesk/blacklists, permit_sasl_authenticated, reject_sender_login_mismatch, reject_authenticated_sender_login_mismatch, reject_known_sender_login_mismatch, reject_unauthenticated_sender_login_mismatch, permit_mynetworks
smtpd_client_restrictions = permit_sasl_authenticated, reject_unauth_pipelining
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination, reject_invalid_helo_hostname, reject_unauth_pipelining, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_non_fqdn_recipient, reject_unknown_recipient_domain