I am working with a friend who is using Postfix on a RHEL3 server. He has iptables blocking port 25 traffic from everywhere except his anti-spam service. He is still receiving mail that reports in the email header that it is coming from other IP addresses.
I have looked at the mail log and it is only reporting connections from the spam service’s ips.
So my working theory is that IP is being spoofed and the headers are wrong. Is this possible? Any suggestions on how to prove this theory.
