I'm investigating a mail server blacklist issue.
Our mail server had a user over quota, which resulted in emails being bounced back to senders with a"user over quota" message. Some of these emails are spam with forged From field. The messages are bounced to the forger From address. As a consequence, our server has been added to some blacklist. Does this make sense?
I'm not sure how to address this. I think the "user over quota" message is useful: as a sender, I want to be notified when my message was not delivered.
An option could be to not bounce the message if it is detected as spam. We're using postfix and spamassassin and when displaying such a message with
postcat -q, I can see the message has a huge spam score.
How should we proceed?
In our configuration, spamassassin only marks the messages and each user may use sieve to filter / delete / move messages. Should spamassassin itself delete huge score messages? Should postfix check spam score before bouncing messages, or rather before trying to deliver it in the first place?
I don't want to reinvent the wheel so while my ideas above might work, I'd like to know how people usually solve this.