2

We receive a a lot of spam addressed to (random) non-existing users. This causes postfix to generate "unknown user" bounces to the fake sender.

As a workaround I use a catch-all to redirect any mail to myself and manually forward mail in cause of typos in the local_part.

I want postfix to drop spams to non-existing users and only bounce them when their spam score is below a threshold. That way people trying to send ham to non-existent users will get a notice and there would be less backscatter.

Here the logs file

Sep 11 07:03:31 srv postfix/smtpd[27382]: connect from mailin.example.com[10.13.185.194]
Sep 11 07:03:31 srv postfix/smtpd[27382]: 563393847D: client=mailin.example.com[10.13.185.194]
Sep 11 07:03:31 srv postfix/cleanup[27386]: 563393847D: message-id=<[email protected]>
Sep 11 07:03:31 srv postfix/qmgr[1771]: 563393847D: from=<[email protected]>, size=5341, nrcpt=1 (queue active)
Sep 11 07:03:31 srv postfix/smtpd[27382]: disconnect from mailin.example.com[10.13.185.194]
Sep 11 07:03:33 srv postfix/pickup[26067]: C53A53851C: uid=115 from=<[email protected]>
Sep 11 07:03:33 srv postfix/cleanup[27386]: C53A53851C: message-id=<[email protected]>
Sep 11 07:03:33 srv postfix/pipe[27387]: 563393847D: to=<[email protected]>, relay=spamassassin, delay=2.5, delays=0.05/0.01/0/2.4, dsn=2.0.0, status=sent (delivered via spamassassin service)
Sep 11 07:03:33 srv postfix/qmgr[1771]: 563393847D: removed
Sep 11 07:03:33 srv postfix/qmgr[1771]: C53A53851C: from=<[email protected]>, size=3784, nrcpt=1 (queue active)
Sep 11 07:03:33 srv postfix/local[27392]: C53A53851C: to=<[email protected]>, relay=local, delay=0.25, delays=0.11/0.01/0/0.13, dsn=5.1.1, status=bounced (unknown user: "kn")
Sep 11 07:03:33 srv postfix/cleanup[27386]: F2879384E6: message-id=<[email protected]>
Sep 11 07:03:34 srv postfix/bounce[27393]: C53A53851C: sender non-delivery notification: F2879384E6
Sep 11 07:03:34 srv postfix/qmgr[1771]: F2879384E6: from=<>, size=5665, nrcpt=1 (queue active)
Sep 11 07:03:34 srv postfix/qmgr[1771]: C53A53851C: removed
Sep 11 07:03:34 srv postfix/smtp[27394]: F2879384E6: to=<[email protected]>, relay=mailout.example.com[10.13.60.4]:25, delay=0.08, delays=0.04/0.01/0.01/0.02, dsn=2.0.0, status=sent (250 OK id=1R2e4j-0001L0-QU)
Sep 11 07:03:34 srv postfix/qmgr[1771]: F2879384E6: removed
Improve this question
4
  • I pasted a logfile entry. The local user "kn" does not exist and it is very likely that the message did not get sent by <[email protected]>, so i don't want kjziswt to be notified. For me, it looks as if the message has been scanned at this point, so I naively assume that there is a possibility to use that information.
    – FabianW
    Oct 11, 2011 at 17:39
  • Indeed this logfile confirms that your setup is broken. You first have to check for the existence of the user and then check for Spam. We need the main.cf to show you where the error is.
    – mailq
    Oct 11, 2011 at 18:38
  • Okay, I'm beginning to understand. In my example "xyz.rostelecom.ru" would somehow (mailin is involved) get the 550 and would bounce the message to the sender which a spambot wouldn't do. In my main.cf spamassassin is invoked very early which is not how it should be. It may have been put there because of legacy procmail scripts used for delivery which check vor SA-Headers. At least I now have an idea where to look. Thanks a lot for your answers! Is there a way to close this question? I don't think there are more people with configurations like this (and if so they wouldn't find this ;) ).
    – FabianW
    Oct 11, 2011 at 20:00
  • 1
    Under my questions there is always the "delete" link...
    – mailq
    Oct 11, 2011 at 20:10

2 Answers 2

Reset to default
3

Unfortunately, the server checks for an existing recipient (against the envelope recipient) before it ever sees the message. It's not possible to check if the message is spam.

The only things that come before this check are the "server helo" and "envelope from"; which you could try to filter (SPF and rDNS lookups spring to mind immediately). You could also use RFC-Exploit Anti-Spam checks like Graylisting.

Improve this answer
6
  • 1
    Sorry Chris. Either I don't get the question or your answer. If the recipient doesn't exist Postfix can reject the mail without knowing the content. Not existing users don't deserve mails.
    – mailq
    Oct 11, 2011 at 16:36
  • @Mailq, (by default) if the user doesn't exist then Postfix will bounce the incoming transmission before it receives the message. Or you can configure the server to accept any transmission with a catch all. The catch all address will get the message though, and the sending server will think the mail was properly delivered. You can't look over the whole message, check for spam and existing recipient, then bounce or deliver the message based on those two criteria (which is what the Q is asking for). Per RFC, once you get to the message data you can no longer return error 550 mailbox not found
    – Chris S
    Oct 11, 2011 at 17:10
  • Okay. Maybe my English skills are not that good. But bouncing a mail would be to create a NDR as in RFC 3464. But by default Postfix rejects a mail if the user is unknown. This is during SMTP dialog and doesn't require a bounce message to be created (RFC 5321 section 6)
    – mailq
    Oct 11, 2011 at 18:53
  • A sending a bounce message is done by the "sending" MTA. The "receiving" MTA, which is where the mailbox's existence is verified, does not generate the NDR, but does send SMTP error code 550 to the "sending" MTA. You could violate RFC and have the "receiving" MTA send a NDR if it determines the message to be spam and to a non-existent mailbox. However that would defeat the purpose, the "sending" MTA is Spam Software, and now things the e-mail address it tried to send e-mail to is a valid e-mail address, even if it is not.
    – Chris S
    Oct 11, 2011 at 19:16
  • 1
    Perfect. Then we both know that we are SMTP and MTA experts. And we both confirm that Fabian's setup is broken and should be fixed really quick.
    – mailq
    Oct 11, 2011 at 19:20
1

Your setup is really broken!

Do not activate Catch-All. Then Postfix has to know which addresses are valid and which not. Then Postfix will automatically rejects any mail to an unknown recipient (unknown user) while the sending server tries to deliver the mail. In this case Postfix never sends a bounce message. This behavior is enabled by default and you really must have messed with the configuration when you generate bounces for "user unknown".

Improve this answer
3
  • The fact that Postfix never sends a bounce message is the reason I'm asking the questions.
    – FabianW
    Oct 11, 2011 at 16:57
  • I agree about the setup being broken. That's why I want to change it. Maybe I have a false undestanding of a "Bounce". It is normal behaviour if the server tells the sender about unknown users like "550 550 unknown user" isn't it?
    – FabianW
    Oct 11, 2011 at 17:02
  • @FabianW You are correct that error 550 is Mailbox Not Found, but you only get to see the message if you don't send that code.
    – Chris S
    Oct 11, 2011 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .