Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have two Postfix mailservers in a University environment. There are thousands of servers managed by a dozen different groups, and I do not control all of the hosts. These servers use my mailservers for routing email, either as a Smarthost or using MX records.

Several servers are continuously sending email where the from address is like:

cfengine@host.example.org

These emails are sent to an invalid address, and thus bounce. But since the "From:" address is also invalid, the emails are stuck in an endless bounce loop for several days.

If I list the postfix queue with postqueue -p shows me hundreds of messages like the following:

ABCD7301713E     3799 Tue Mar  5 05:20:35  MAILER-DAEMON
(delivery temporarily suspended: connect to host.example.org[192.168.100.100]:25: Connection refused)
                                         cfengine@host.example.org
  1. Using Postfix on the mailservers, is it possible to rewrite either the "From:" address or the "To:" address in these emails? I would like to direct them to the system owners and request that they clean up their systems.
  2. Can I notify Postmaster about these bounces? Postmaster can then notify the system owners.
share|improve this question
add comment

2 Answers

Once solution is to notify somebody about the bounces. postmaster is sometimes used for this task. The parameters notify_classes and bounce_notice_recipient may allow me to notify the postmaster that bounces are happening.

The bounce message may contain the Hostname & IP of the host which is attempting to deliver the email. If not, the administrator can run the postcat command on the Message-Id and see the contents of the message (headers and all). From here, we can contact the system owner and ask them to fix the problem on their side.

bounce (also implies 2bounce)

Send the postmaster copies of the headers of bounced mail, and send transcripts of SMTP sessions when Postfix rejects mail. The notification is sent to the address specified with the bounce_notice_recipient configuration parameter (default: postmaster).

2bounce

Send undeliverable bounced mail to the postmaster. The notification is sent to the address specified with the 2bounce_notice_recipient configuration parameter (default: postmaster).

bounce_notice_recipient (default: postmaster)

The recipient of postmaster notifications with the message headers of mail that Postfix did not deliver and of SMTP conversation transcripts of mail that Postfix did not receive. This feature is enabled with the notify_classes parameter.

2bounce_notice_recipient (default: postmaster)

The recipient of undeliverable mail that cannot be returned to the sender. This feature is enabled with the notify_classes parameter.

share|improve this answer
    
One should always have a functioning postmaster address for the domain, which someone in operations reads regularly. In this case it shouldn't be hard to find the machine from where the email originated (it's a few days ago in the log entries) and then hunt down the owner of the machine. –  Michael Hampton Mar 6 '13 at 4:45
    
@MichaelHampton We do have a postmaster address, and it is monitored. But the default Postfix configuration does not deliver bounce notifications to this address, which is somewhat surprising. –  Stefan Lasiewski Mar 6 '13 at 14:31
    
Not at all surprising. On a production mail server with any significant volume, sending bounce notices would flood the postmaster mailbox. That's what that the log is for. –  J Adams Mar 7 '13 at 0:47
add comment

Have you considered rejecting messages with invalid envelope sender in SMTP session?


You could chhose one of the following:

  • add "unresponsive host" to access table with REJECT action
  • use policy filter.
    The file examples/smtpd-policy/greylist.pl in the Postfix source tree implements a simplified greylist policy server
  • use custom milter
    MIMEDefang.org milter lets you express your filtering policies in Perl - it is worth co consider if you plan to add also spam/virus filtering

IMHO In SMTP session rejecting is what SHOULD be done but too frequently it can not be done for non technical reason.

share|improve this answer
    
Would this reject email sent from within my network which does not match a specified pattern? –  Stefan Lasiewski Mar 21 '13 at 20:46
    
Yes in simple cases. I think you would prefer functionality provided by policy filters or milter filters. AFAIK milters can rewrite envelope sender address. –  Andrzej A. Filip Mar 21 '13 at 21:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.