Sender check for outgoing mail

Question

Hi,
I want to enabled sender check on all outgoing mail. i.e ironport should check if the from address is listed in my ldap.
This is required because spammer is sending mails by compromising legitimate users credentials and sending mail through out setup.
all the spam mails which are quarantine on ironport are having invalid from addresses.
Thanks in advance.
Regards,
HOmesh

Answer 1

Deploying SPF (Sender Policy Framework) might decrease such incoming mail traffic using your email domain namespace as forged senders in SMTP envelopes.
http://en.wikipedia.org/wiki/Sender_Policy_Framework
To deploy SPF using it's most strictiest policy, you must be able to declare legimate sources where the mail from your domain can be originated from. Ip source addresses, netblocks, FQDN names, reverse domains, etc.
If you have one singe (or clustered) C-series mail router in DMZ and all the mail traffic from @yourdomain.com can be routed outbound fvia these C-series boxes only, then you can setup your SPF records that way, that only your C-series box(es) are legimate mail sources.
If you use RFC 1918 private addressing internally, that's it.
If you use public, routable ip addressing internally, you might need to add that network into your SPF record, but it depends how the mail traffic is routed there.
The configure your Ironport C-series appliances using SPF. If you have inbound forged mail coming in and if the source ip addr of SMTP peer is not listed in your SPF records and if you use strictiest SPF policy, your C-series appliance will reject these inbound connections.