Prevent spam being forwarded by Postfix (while locally delivered to a Junk folder)

Question

We have a pretty standard Postfix/Amavis setup where we use the Dovecot LDA to deliver mail locally. Amavis passed spam mail and we use Sieve to drop it in the Junk folder of the user.

The problem is that mail that is tagged as spam by our Amavis, should not being forwarded to an external address. I don't see how to achieve this.

I did find some references to Postfix header_checks, but these are handled by the cleanup process which is before Amavis starts checking. Forwarding like goes like this:

Dec 13 23:13:32 mail postfix/smtpd[14405]: connect from ...
Dec 13 23:13:32 mail postfix/smtpd[14405]: Anonymous TLS connection established from ... SSLv3 with cipher AES128-SHA (128/128 bits)
Dec 13 23:13:32 mail postfix/smtpd[14405]: 5659141F35: client=..., sasl_method=PLAIN, sasl_username=test.piet@...
Dec 13 23:13:32 mail postfix/cleanup[14251]: 5659141F35: message-id=<[email protected]>
Dec 13 23:13:32 mail postfix/qmgr[13623]: 5659141F35: from=<test.piet@...>, size=1701, nrcpt=1 (queue active)
Dec 13 23:13:32 mail postfix/smtpd[14405]: disconnect from ...
Dec 13 23:13:37 mail postfix/smtpd[14358]: connect from localhost[127.0.0.1]
Dec 13 23:13:37 mail postfix/smtpd[14358]: ACF4F42260: client=localhost[127.0.0.1]
Dec 13 23:13:37 mail postfix/cleanup[14251]: ACF4F42260: message-id=<[email protected]>
Dec 13 23:13:37 mail postfix/smtpd[14358]: disconnect from localhost[127.0.0.1]
Dec 13 23:13:37 mail postfix/qmgr[13623]: ACF4F42260: from=<test.piet@...>, size=2408, nrcpt=1 (queue active)
Dec 13 23:13:37 mail amavis[11530]: (11530-14) Passed SPAM, [188.142.56.16] [188.142.56.16] <test.piet@...> -> <mark.ruys@...>, Message-ID: <[email protected]>, mail_id: iTVFrnGF7RaS, Hits: 999.001, size: 1701, queued_as: ACF4F42260, 5305 ms
Dec 13 23:13:37 mail postfix/smtp[14253]: 5659141F35: to=<mark.ruys@...>, orig_to=<mark@...>, relay=127.0.0.1[127.0.0.1]:10024, delay=5.4, delays=0.11/0/0/5.3, dsn=2.0.0, status=sent (250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as ACF4F42260)
Dec 13 23:13:37 mail postfix/qmgr[13623]: 5659141F35: removed
Dec 13 23:13:37 mail postfix/smtp[14414]: Trusted TLS connection established to gmail-smtp-in.l.google.com[173.194.65.26]:25: TLSv1.1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)
Dec 13 23:13:38 mail postfix/smtp[14414]: ACF4F42260: to=<mark.ruys@...>, relay=gmail-smtp-in.l.google.com[173.194.65.26]:25, delay=0.84, delays=0/0.02/0.08/0.73, dsn=2.0.0, status=sent (250 2.0.0 OK 1386972818 f8si3542819eep.162 - gsmtp)
Dec 13 23:13:38 mail postfix/qmgr[13623]: ACF4F42260: removed

Answer 1

General solution

If you have another server, then the solution was trivial. Supposedly, the another box is called second.example.com. On your original box, set in main.cf a relayhost to second.example.com

relayhost = [second.example.com]:25

In second.example.com, set header_checks to checks if the email was likely a spam, either by checking the SPAM word in your subject or by checking spam score in header. For this example, I'll use subject checking method. The header_checks syntax is

/^Subject: \[SPAM\]/ DISCARD

Done. Now the aliases email will flow through second.example.com and will be dropped when it's spam.

---

If you don't have another server, then your likely option is setup additional smtpd daemon in master.cf or Postfix Multiple Instances.

Additional smtpd Daemon

status: It doesn't work

The idea is adding new smtpd listen another port and override the configuration for header_checks and relayhost. In main.cf add relayhost configuration to another smtpd daemon.

relayhost = [127.0.0.1]:12225

Define in master.cf and override the header_checks to checks spam-tagged email and emptying relayhost so it doesn't loops to itself.

[127.0.0.1]:12225    inet  n       -       n       -       -       smtpd
   -o header_checks=pcre:/etc/postfix/killspam
   -o relayhost=

Unfortunately, this is not working. According to the man 8 smtpd, the smtpd silently refuse the parameter other than listed in this man page. So, it still use old configuration in main.cf.

Postfix Multiple Instances

status: It works

The idea is setup one default instance to handle incoming emails and another one to handle outgoing emails like above setup. I don't give you a details, but you should adjust some parameter to get second instance running. Then add additional configuration like empty relayhost and header_checks.