If you put your mail server's smtp on an alternate port and let Spamfilter handle both incoming and outgoing, I beleave you wont have to problem that much.  Spamfilter is capable of handling authentication for your users then handing off mail to your mail server to actually do the sending of the mail.  This is the way I have mine setup and it traps all spam on both sides.  It also tells me if a user on the network has been abusing/sending spam.

This has already been checked. didn't not work.

IKILLSPAM1 wrote: Hey Stupid, lol, well that is your name. An easier approach would be to go into Filter Settings and check off From domain = To Domain This would block your example above. I do this as well.

However,  SPF doesn't do any good if the  spammer used the 'Return Path' to specify the senders name as SPF only checks the FROM: field.

WebGuyz wrote: However,  SPF doesn't do any good if the  spammer used the 'Return Path' to specify the senders name as SPF only checks the FROM: field.

Actually the "Return-Path" header cannot be used by spammers/users. The "Return Path" header is added by *mail servers* when they receive the email. It will replace whatever "Return-Path" is already present in the email, and will be populated by the mail server with the address in the "MAIL FROM" command, which is the one SpamFilter acts upon.

Please note that SpamFilter will also add another header, X-SF-RX-Return-Path, that will contain the same address we added in the "Return-Path". This is because when SpamFilter forwards an email to a server, this latter mail server will also replace the "Return-Path" with the "MAIL FROM" it receives. We just want to make sure we document in the email's headers what "MAIL FROM" was used to send the email to SpamFilter, in case this somehow changes during the email's life.

I honestly do not think it would work. Enabling the filter that blocks emails where the "FROM domain = TO domain" should stop all the same emails that would be stopped if you added all your users in a "from blacklist". In addition, the "FROM domain = TO domain" filter should also block additional emails even from fake senders that simulate incorrect, random users from your domains, which would not be blocked by your blacklist.

Please note that SpamFilter ignores the address in the "From" header, as that is used only to display an email address in Outlook clients. The actual address being acted upon is the one specified in the "MAIL FROM" command, which is usually the same one that mail servers will add to the "Return Path". SpamFilter logs that address in the header "X-SF-RX-Return-Path".