Hey everyone,
Do anyone know how to reliably configure the email role to deny mail spoofing? I have default settings, except that i have smarthost configured (mailbaby).
The problem:
I manage my own email in enhance, so i have an email address for xy@myhosting.com. I've also created an email address for one of my client: xyclient@clientsite.com. Now, if i log in with xyclient@clientsite.com in roundcube, i can add xz@myhosting.com as an identity and i can send an email as if im one of the employees of myhosting.com. This is possibly an issue between xy@clientsite.com and yx@otherclientsite.com too.
Things i've tried:
I can edit the roundcube configuration of the main roundcube instance (webmail.myhosting.com), so i can set: $config['identities_level'] = 3;. This way no one can create new identities in the main roundcube instance. I can still create abusive identities after i log in at mail.clientsite.com as i don't know how to edit those configs.
Roundcube configuration may still not be enough. I have experience with docker mailserver, and it has a SPOOF_PROTECTION setting that tackles the problem on a deeper level. Maybe enhance should have a similar setting too.
