Question Email sender permissions

[SKDamon]

Hello,

I'm currently exploring Plesk's mail capabilities. I searched for an option to add a "sender address" to individual email accounts of a domain, but couldn't find any.

To my surprise, I was able to add a sender address of an existing mail account on the same domain in Outlook, using the original account's login, and send emails "from" that address.

Is there any way to prohibit users from sending through other mail addresses on the same domain?

Steps to reproduce:
On a domain (example.com), add 2 mail accounts: boss@ and apprentice@
Configure apprentice@ account in Outlook (new Profile)
Write an email, select "additional email address" in the "From" dropdown of Outlook
enter boss@example.com in "From" field, leave apprentice@example.com as "Send with", hit OK
Send Email to a third account

The third account will receive a mail from boss@example.com, even though there aren't any credentials configured for boss@example.com. /var/log/mail.log shows the sasl_username used was apprentice@

To be precise the mail header From is set to boss@example.com, and the Sender header ist set to apprentice@example.com. To an end user, it still looks like boss@ sent the mail, which is excellent for fraudsters. Gmail on Android just shows boss@example.com as the sender, no mention of the configured Name or Address of apprentice@...

Can this be prevented? Either in Plesk, or in Postfix?

 

[RaHa]

Insert in main.cf:
smtp_header_checks = regexp:/etc/postfix/header_checks_smtp

Content of header_checks_smtp:
/^From: boss@example.com/ REPLACE From: apprentice@example.com.