各位IT的先進好：
目前我們mailserver環境為postfix+Mailsanner+sapmassain，最近常收到一種比特幣的詐騙信，覺得很疑惑，煩請知道的人幫我釋疑，我在postfix main.cf上有設定以下限制，理論上對方如果假冒我們網域寄信來應該會直接被丟棄。

smtpd_sender_restrictions = permit_mynetworks,
                            permit_sasl_authenticated,
                  **check_sender_access hash:/etc/postfix/check_sender**

check_sender內容為mail.example.com        DISCARD

但是奇怪的是，user收下後發現寄件者是他自己，我看一下mail擋頭有兩個from，但不知道為何user端是顯示下面一組假冒的email，但我實際上又複查maillog，當時寄件進來的是第一組真實的from位址，所以才沒被上面限制所擋下，我很疑惑如何產生第二組假冒的from email，又該如何防堵呢？

郵件擋頭
From camille.voisin@radiopole-artois.com 實際寄信位址 Sun May  5 19:51:31 2019
Return-Path: <camille.voisin@radiopole-artois.com>
X-Spam-Status: Yes
X-example-MailScanner-From: camille.voisin@radiopole-artois.com
X-example-MailScanner-SpamScore: sssssssssssssss
X-example-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
	score=15.198, required 5, FORGED_MUA_MOZILLA 1.60,
	HEADER_FROM_DIFFERENT_DOMAINS 5.00, HTML_IMAGE_ONLY_04 0.34,
	HTML_MESSAGE 0.00, LOCALPART_IN_SUBJECT 0.73, MIME_HTML_MOSTLY 0.00,
	MPART_ALT_DIFF 0.72, RCVD_IN_BL_SPAMCOP_NET 1.25,
	RCVD_IN_DNSWL_NONE -0.00, RCVD_IN_SBL_CSS 3.56,
	TO_NO_BRKTS_HTML_IMG 2.00)
X-example-MailScanner: Found to be clean
X-example-MailScanner-ID: A5E8940ED698.A2F81
X-example-MailScanner-Information: Scaned by mail.example.com
Received: from webmail.radiopole-artois.com (radiopole-artois.com [92.103.138.147])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mail.example.com (Postfix) with ESMTPS id A5E8940ED698
	for <user1@mail.example.com>; Sun,  5 May 2019 19:50:46 +0800 (CST)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.example.com A5E8940ED698
Received: from localhost (localhost [127.0.0.1])
	by webmail.radiopole-artois.com (Postfix) with ESMTP id 584FF37AB22
	for <user1@mail.example.com>; Sun,  5 May 2019 13:29:14 +0200 (CEST)
Received: from webmail.radiopole-artois.com ([127.0.0.1])
	by localhost (webmail.radiopole-artois.com [127.0.0.1]) (amavisd-new, port 10032)
	with ESMTP id UpWpT5P9WE86 for <user1@mail.example.com>;
	Sun,  5 May 2019 13:29:14 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
	by webmail.radiopole-artois.com (Postfix) with ESMTP id 3F4CD37A98A
	for <user1@mail.example.com>; Sun,  5 May 2019 13:29:14 +0200 (CEST)
X-Virus-Scanned: amavisd-new at webmail.radiopole-artois.com
Received: from webmail.radiopole-artois.com ([127.0.0.1])
	by localhost (webmail.radiopole-artois.com [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id n1WSP56lQp_M for <user1@mail.example.com>;
	Sun,  5 May 2019 13:29:13 +0200 (CEST)
Received: from [85-192-163-151.dsl.esoo.ru] (85-192-163-151.dsl.esoo.ru [85.192.163.151])
	by webmail.radiopole-artois.com (Postfix) with ESMTPSA id DE856379F69
	for <user1@mail.example.com>; Sun,  5 May 2019 13:29:05 +0200 (CEST)
From: <user1@mail.example.com>  <--被假冒的位址，並會顯示在outlook寄件者上
X-aid: 3501491858
Errors-To: update+6yz8bu0be@radiopole-artois.com
Content-Type: multipart/related;
 boundary="elgunmdruh-E01AD30BC3700B170D9-gqkrhyrzxe-3D501A5C5C397-qgqhontzg-08E67D"
MIME-Version: 1.0
To: user1@mail.example.com
X-Priority: Critical

maillog內容，postfix記錄的是camille.voisin@radiopole-artois.com寄給user1@mail.example.com，所以才沒被擋下

May  5 19:50:45 mail postfix/smtpd[4808]: connect from radiopole-artois.com[92.103.138.147]
May  5 19:50:46 mail postfix/smtpd[4808]: Anonymous TLS connection established from radiopole-artois.com[92.103.138.147]: TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)
May  5 19:50:46 mail postfix/smtpd[4808]: A5E8940ED698: client=radiopole-artois.com[92.103.138.147]
May  5 19:50:46 mail postfix/cleanup[4814]: A5E8940ED698: hold: header Received: from webmail.radiopole-artois.com (radiopole-artois.com [92.103.138.147])??(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))??(No client certificate requested)??by mail.example.com from radiopole-artois.com[92.103.138.147]; from=<camille.voisin@radiopole-artois.com> to=<user1@mail.example.com> proto=ESMTP helo=<webmail.radiopole-artois.com>