# spoofguard

A postfix companion to prevent spoofing sender addresses, while
allowing some exceptions though.


## Basic setup

Create file `spoofguard.ini`:

```
[DEFAULT]
interface = 127.0.0.1
port = 9001
mapping_file = sender_login_map
```

Create file `sender_login_map` (follow the same format as [smtpd_sender_login_maps] plus
special comment syntax to allow defining superusers):

```
# Each line maps one "From:" addresse to one or more sasl usernames, space-separtaed

# Special lines beginning with "# * ..." designate superusers
# * root admin

toto@example.com toto
tata@example.com tata
sales-department@example.com toto tata
```

Start spoofguard:

```
spoofguard -c spoofguard.ini -v --dry-run
```

With the option `--dry-run` spoofguard will not reject any outgoing email, instead it will just
write warnings to logs if unallowed spoofing occur.
You may remove `--dry-run` when you feel confident with your `sender_login_map` file :)


Configure postfix (in `main.cf`):

```
submission_smtpd_end_of_data_restrictions =
    ...
    check_policy_service inet:127.0.0.1:9001
```

Reload postfix: `systemctl reload postfix`

[smtpd_sender_login_maps]: https://www.postfix.org/postconf.5.html#smtpd_sender_login_maps
