Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

we've inherited the DNS from another ISP and now our mail server is bombed by about 1000 emails per minute, 99.99% of these emails are just spam. We're trying to optimize the filtering/rejecting the spam with no much luck.

What would be on your opinion the optimal set for smtpd_recipient_restrictions?

The system config: Ubuntu + Amavis + Postfix + MySQL + Fail2Ban-Postfix

Any advise is welcome!

UDPATE, 2012-08-08

On alteration of the posftix configuration as folows and configuring the Potrgey service the spam level decayed 10 times

smtpd_recipient_restrictions = 
permit_mynetworks, 
permit_sasl_authenticated, 
reject_non_fqdn_hostname, 
reject_invalid_hostname, 
reject_non_fqdn_sender, 
reject_unknown_sender_domain, 
reject_non_fqdn_recipient, 
reject_unknown_recipient_domain, 
check_policy_service inet:127.0.0.1:10023, 
reject_rbl_client zen.spamhaus.org, 
check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf,
reject_unauth_pipelining, 
reject_unauth_destination

enter image description here

share|improve this question
1  
I want to buy that domain! Please place an offer. –  mailq Sep 14 '11 at 20:32
    
What are you trying to solve? What is your problem? You only say that you reject Spam. But this is not a problem. This is a solution. –  mailq Sep 14 '11 at 20:44
    
@mailq: no way i'm sorry –  Igor Sep 16 '11 at 7:21
    
@mailq: the idea is to reject spam more effectively, reduce the system loads –  Igor Sep 16 '11 at 7:23

2 Answers 2

up vote 4 down vote accepted

You order of rules is very bad. If you want to keep all of them and not add anything else, the order must be:

smtpd_recipient_restrictions = 
permit_mynetworks, 
permit_sasl_authenticated, 
reject_unauth_pipelining, 
reject_invalid_hostname, 
reject_non_fqdn_sender, 
reject_unknown_sender_domain, 
reject_unauth_destination, 
reject_unknown_recipient_domain, 
reject_rbl_client zen.spamhaus.org,
check_recipient_access proxy:mysql:/etc/postfix/mysql-virtual_recipient.cf, 
reject_non_fqdn_recipient

And if that still is not enough then read about postscreen in http://www.postfix.org/POSTSCREEN_README.html.

share|improve this answer
    
sorry but does the order matter or not? in a sense postfix verifies at first "permit_mynetworks" and at last "reject_non_fqdn_recipient". –  Igor Sep 16 '11 at 13:49
    
Definitively! Order matters. From left to right (or up to down). As described in postfix.org/SMTPD_ACCESS_README.html –  mailq Sep 16 '11 at 23:19
    
ok, thank you so much! –  Igor Sep 17 '11 at 1:33

I would suggest a smtpd_recipient_restriction similar to the following:

smtpd_recipient_restricdtions = 
# Whitelisting or blacklisting:
check_recipient_access proxy:mysql:/etc/postfix/mysql-virtual_recipient.cf,
# Everyone should play after rules:
reject_non_fqdn_recipient,
reject_non_fqdn_sender,
reject_unknown_recipient_domain,
reject_unknown_sender_domain,
reject_unauth_pipelining,
# Mails from your users:
permit_mynetworks,
permit_sasl_authenticated,
# This will block mails from domains with no reverse DNS record. Will affect both spam and ham mails, but mostly spam. 
reject_unknown_reverse_client_hostname,
# Instead of reject_unknown_reverse_client_hostname you can also use reject_unknown_client_hostname, which is an even harder rule. 
# Reject ugly HELO/EHLO-hostnames (could also affect regular mails):
reject_non_fqdn_hostname,
reject_invalid_helo_hostname,
# Reject everything you're not responsible for:
reject_unauth_destination,
# Only take mails for existing accounts:
reject_unverified_recipient,
# DNS lookups are "expensive", therefore should be at bottom
reject_rbl_client zen.spamhaus.org

Detailed infos on smtpd_recipient_restrictions can be found here: http://www.postfix.org/postconf.5.html#smtpd_recipient_restrictions

Maybe you also want to use postgrey, postscreen, postfwd or some other policy daemon.

And also check, that you are using your amavisd-new in pre-queue mode.

share|improve this answer
    
This is bad. The second line blocks mail for any outbound recipient. So you are not able to send mails from your server to the outside world. MySQL queries are equally expensive as DNS queries. So you should also move MySQL queries to the bottom. –  mailq Sep 16 '11 at 23:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.