up vote 1 down vote favorite
share [g+] share [fb]

We receive a a lot of spam addressed to (random) non-existing users. This causes postfix to generate "unknown user" bounces to the fake sender.

As a workaround I use a catch-all to redirect any mail to myself and manually forward mail in cause of typos in the local_part.

I want postfix to drop spams to non-existing users and only bounce them when their spam score is below a threshold. That way people trying to send ham to non-existent users will get a notice and there would be less backscatter.

link|improve this question
I pasted a logfile entry. The local user "kn" does not exist and it is very likely that the message did not get sent by <kjziswt@example.com>, so i don't want kjziswt to be notified. For me, it looks as if the message has been scanned at this point, so I naively assume that there is a possibility to use that information. – FabianW Oct 11 '11 at 17:39
Indeed this logfile confirms that your setup is broken. You first have to check for the existence of the user and then check for Spam. We need the main.cf to show you where the error is. – mailq Oct 11 '11 at 18:38
Okay, I'm beginning to understand. In my example "xyz.rostelecom.ru" would somehow (mailin is involved) get the 550 and would bounce the message to the sender which a spambot wouldn't do. In my main.cf spamassassin is invoked very early which is not how it should be. It may have been put there because of legacy procmail scripts used for delivery which check vor SA-Headers. At least I now have an idea where to look. Thanks a lot for your answers! Is there a way to close this question? I don't think there are more people with configurations like this (and if so they wouldn't find this ;) ). – FabianW Oct 11 '11 at 20:00
Under my questions there is always the "delete" link... – mailq Oct 11 '11 at 20:10
feedback

2 Answers

up vote 2 down vote

Unfortunately, the server checks for an existing recipient (against the envelope recipient) before it ever sees the message. It's not possible to check if the message is spam.

The only things that come before this check are the "server helo" and "envelope from"; which you could try to filter (SPF and rDNS lookups spring to mind immediately). You could also use RFC-Exploit Anti-Spam checks like Graylisting.

link|improve this answer
Sorry Chris. Either I don't get the question or your answer. If the recipient doesn't exist Postfix can reject the mail without knowing the content. Not existing users don't deserve mails. – mailq Oct 11 '11 at 16:36
@Mailq, (by default) if the user doesn't exist then Postfix will bounce the incoming transmission before it receives the message. Or you can configure the server to accept any transmission with a catch all. The catch all address will get the message though, and the sending server will think the mail was properly delivered. You can't look over the whole message, check for spam and existing recipient, then bounce or deliver the message based on those two criteria (which is what the Q is asking for). Per RFC, once you get to the message data you can no longer return error 550 mailbox not found – Chris S♦ Oct 11 '11 at 17:10
Okay. Maybe my English skills are not that good. But bouncing a mail would be to create a NDR as in RFC 3464. But by default Postfix rejects a mail if the user is unknown. This is during SMTP dialog and doesn't require a bounce message to be created (RFC 5321 section 6) – mailq Oct 11 '11 at 18:53
A sending a bounce message is done by the "sending" MTA. The "receiving" MTA, which is where the mailbox's existence is verified, does not generate the NDR, but does send SMTP error code 550 to the "sending" MTA. You could violate RFC and have the "receiving" MTA send a NDR if it determines the message to be spam and to a non-existent mailbox. However that would defeat the purpose, the "sending" MTA is Spam Software, and now things the e-mail address it tried to send e-mail to is a valid e-mail address, even if it is not. – Chris S♦ Oct 11 '11 at 19:16
Perfect. Then we both know that we are SMTP and MTA experts. And we both confirm that Fabian's setup is broken and should be fixed really quick. – mailq Oct 11 '11 at 19:20
show 1 more comment
feedback
up vote 0 down vote

Your setup is really broken!

Do not activate Catch-All. Then Postfix has to know which addresses are valid and which not. Then Postfix will automatically rejects any mail to an unknown recipient (unknown user) while the sending server tries to deliver the mail. In this case Postfix never sends a bounce message. This behavior is enabled by default and you really must have messed with the configuration when you generate bounces for "user unknown".

link|improve this answer
The fact that Postfix never sends a bounce message is the reason I'm asking the questions. – FabianW Oct 11 '11 at 16:57
I agree about the setup being broken. That's why I want to change it. Maybe I have a false undestanding of a "Bounce". It is normal behaviour if the server tells the sender about unknown users like "550 550 unknown user" isn't it? – FabianW Oct 11 '11 at 17:02
@FabianW You are correct that error 550 is Mailbox Not Found, but you only get to see the message if you don't send that code. – Chris S♦ Oct 11 '11 at 17:12
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.