Ironport - Spoof Protection using Sender Verification

 Issue:

Envelope sender address is spoofed, looks come from local domain

Mail Flow Policy has setting can do DNS verification on envelope sender domain for three situations:

domain doesn't exist
domain doesn't resolve
malformed

Mail Flow Policy has another setting called Sender Verification Exception Table, which can be used to bypass above envelope sender DNS verification for specified domain with Allow behavior. It also can be used to reject envelope sender for specified domain with Reject behavior

So if we can add the local domain to this Exception Table with Reject behavior, this can drop the spoofed envelop sender email.

 

Configure Exception Table

1. From the GUI: Mail Policies > Exception Table > Add Sender Verification Exception...
2. Add the local domain to the Sender Verification Exception Table
3. Set the Behavior to Reject

Configure Mail Flow Policy (MFP)

1. For a specific Mail Flow, In Mail Policies > Mail Flow Policies > [mail flow], set Use Sender Verification Exception Table configuration to On
2. To make is default to all Mail Flow, In Mail Policies > Mail Flow Policies > Default Policy Parameters, set Use Sender Verification Exception Table configuration to On.

In case need 3rd party organization to send email on behalf of your company, we need a new Mail Flow with Exception Table turned OFF, then create a new Sender Group for this 3rd party to use the new Mail Flow.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/200057-Spoof-Protection-using-Sender-Verificati.html