Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to stop spam from one sender. They each time uses another mail server. here is headers from original email (i replaced my email and host with:, sender email and host i replaced with:, all other is unchanged):

From - Mon Jan 27 14:17:08 2014
X-Account-Key: account7
X-UIDL: 1201266183.11294
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <>
Received: from ([unix socket])
     by localhost (Cyrus v2.2.13-Debian-2.2.13-10) with LMTPA;
     Mon, 27 Jan 2014 14:15:18 +0200
X-Sieve: CMU Sieve 2.2
X-Greylist: delayed 460 seconds by postgrey-1.27 at mnl-bck; Mon, 27 Jan 2014 14:15:05 EET
Received: from ( [])
    by (ESMTP daemon) with ESMTP id 999EA15F505
    for <>; Mon, 27 Jan 2014 14:15:05 +0200 (EET)
MIME-Version: 1.0
From: Blah blah blah <>
Reply-To: Blah blah blah <>
Subject: {(***Disarmed***)} =?UTF-8?B?VmFsZW50xKtuYSBkaWVuYSBuxIFrIQ==?=
Date: Mon, 27 Jan 2014 12:07:07 +0000
DKIM-Signature: v=1; a=rsa-sha1; q=dns/txt; l=6092; s=default;
    t=1390824427; c=relaxed/simple;
    z=From:=20Blah blah blah=20<>
Content-Type: multipart/alternative;
Message-Id: <> Found to be clean  2.77

Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"

I edited /etc/postfix/sender_access to reject email from But that does not work, because postfix is seeing that email comes from different sender/server. From postfix log file:

Jan 27 14:15:05 myMailServer postfix/smtpd[12822]: connect from[]
Jan 27 14:15:05 myMailServer postgrey[4304]: delayed 460 seconds:,,
Jan 27 14:15:05 myMailServer postfix/policy-spf[12827]: : testing: stripped, stripped
Jan 27 14:15:05 myMailServer postfix/policy-spf[12827]: : SPF pass: smtp_comment=Please see contains, header_comment=myMailServer: domain of 4a590193769-1-589@delivery-gate.comdesignates as permitted sender
Jan 27 14:15:05 myMailServer postfix/policy-spf[12827]: decided action=DUNNO
Jan 27 14:15:05 myMailServer postfix/smtpd[12822]: 999EA15F505:[]
Jan 27 14:15:05 myMailServer postfix/cleanup[12829]: 999EA15F505: hold: header Received: from ( [])??by (ESMTP daemon) with ESMTP id 999EA15F505??for <>; Mon, 27 Jan 2014 14:15:05 +0200 (EET) from[]; from=<> to=<> proto=ESMTP helo=<>
Jan 27 14:15:05 myMailServer postfix/cleanup[12829]: 999EA15F505: message-id=<>
Jan 27 14:15:05 myMailServer postfix/smtpd[12822]: disconnect from[]

So, when i am looking message source in thunderbird, i see header: From: Blah blah blah <>. How i can block email from that sender ( There is no point to block IP, because next time it will different. I have also set up MailScanner, but that too does not see proper from header. I already blacklisted that domain in MailScanner too.

share|improve this question
up vote 2 down vote accepted

So you have added REJECT to your sender_access file, have you added hash:/etc/postfix/sender_access to your smtpd_recipient_restrictions = as the first option?

You may also have more luck using the smtp_nested_header_checks option as well, as it allows you to examine any Non-MIME header for identifiers.

share|improve this answer
yes, yes and yes. For other rules it works. Postfix just does not see correct sender from. smtpd_recipient_restrictions = hash:/etc/postfix/access, check_sender_access hash:/etc/postfix/sender_access, permit_sasl_authenticated,... – Guntis Jan 27 '14 at 13:02
Can you show the lines in /var/log/maillog where this email is arriving? It should show the From email that postfix is seeing.. – NickW Jan 27 '14 at 13:07
see my question – Guntis Jan 27 '14 at 13:22
maybe you could just add that email to your spamassassin blacklist, give it 10 points off the bat.. – NickW Jan 27 '14 at 13:24
I was looking, you might be able to catch this guy with smtp_nested_header_checks as well, it's worth looking into at the very least.. – NickW Jan 27 '14 at 13:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.