-1

On Snow Leopard and Lion server there was a filter option to reject (bounce) unwanted spam. With Mountain Lion Server the filtering still works, but it only gets flagged as spam with *** JUNK MAIL ***. Is there a way to change that setting back to rejection? I couldn't find anything in the GUI, but maybe there is a way in some configuration file.

Thanks

1 Answer 1

1

You should never EVER bounce spam -- if you do, you're producing backscatter spam directed at whoever had their address forged as the From address on the original spam messages. It's perfectly reasonable to refuse to receive a message (that is, to reject before receiving the message), but once you've received the message you either deliver it or drop it. And since the filter you're talking about is based on scanning the message contents -- something that can only be done after receiving it -- the option to bounce should not be available here.

(Historical note: IIRC when Apple first added the spamassassin filter to their mail server, the default policy was to bounce spam. This got fixed pretty quickly, but the option stayed available in the GUI for way longer than it should have.)

Mountain Lion Server actually includes 4 different mail filters, with different effective policies:

  1. Blacklisting: disabled by default, but easy to enable (and if you check the box, it defaults to using the zen.spamhaus.org blacklist, which is a reasonable choice IMHO but others would disagree violently). What this does is refuse to receive messages from any sending server that's listed as a known/suspected spam source. This is a perfectly reasonable thing to use (it does not create backscatter, at least on your server), and since it rejects messages before receiving them it's very good for cutting down load on your server.

  2. Greylisting: enabled by default (actually, controlled by the same on/off switch as #3), it will fake a temporary error when an unknown server tries to send a message (actually, it's an unknown sending server/from address/to address combination). Essentially, it tells the sending server there's a problem and it should try again in a bit; a real server will try again in a bit (at which point the greylist will let it in), but many spambots will simply give up.

    Again, this rejects messages before receiving them (good for server load, and does not create backscatter spam), but it has several downsides: First, if you're trying to debug the mail service, having fake errors mixed in with the real ones, it's harder to tell what's going on (and the greylist's fake errors aren't very clearly identified in the logs). Second, it slows down message reception from first-time senders (after the first time, they're on the known list and the message goes right through). This gets really bad with messages coming from gmail/google, since they use a bank of sending servers and it takes forever to learn them all (see this support article). I've actually had to edit the greylist policy script to exempt google's servers in order to get reception from them to work right.

  3. Spam scanning (enabled by default): this runs received messaged through spamassassin to see how spammy they look ("Increase your Rolex mortgage 500% !!!"). Messages that hit the (adjustable) threshold are still delivered, but with a spam warning added to the Subject. The GUI doesn't support changing the deliver-with-warning policy, but it would be possible to make it e.g. drop or quarantine spam by editing the postfix config files. But DO NOT configure it to bounce messages.

  4. Virus scanning (enabled by default): this runs received messages through clamav, and if it finds a known virus the message is quarantined. If you enable it in the Alerts section of Server.app, it can also send you (the admin) an email or push notification message that a virus has been detected. Again, this policy could be changed only by editing the config files.

1
  • Thanks for the extensive answer - I wasn't aware... I am wanting to reactivate Greylisting, but where and how did you edit the greylist policy script for gmail? Thanks
    – Joseph
    Oct 25, 2013 at 8:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .