3

I have Postfix configured to block email from a persistent spammer that has found a "bulletproof" spam service provider (known as Amazon SES), but of course the block fails because the MAIL FROM (aka "Return-Path") is a string such as 01000165f9022c82-37fa3cc3-d63c-4548-be3d-125d50e43aaf-000000@amazonses.com while the From header passed in the DATA command is ThePartyFixxCompany@gmail.com.

Is there a way to block the address/domain in the From header during the SMTP transaction, rather than filtering it to /dev/null with some after-the-fact process like Sieve, Amavis, Spamassassin, etc.?

This answer suggests it's not possible, but then goes on to emphasise a different point that is not relevant to my question, so it's not clear to me that it is absolutely not possible.

I don't think my postconf output is relevant to this question, as Postfix is running as it should be (I'm running 2.10.1.). I'm looking for a configuration tweak. Thanks.

  • 1
    Remember to forward such spam to abuse@amazonaws.com. They're pretty good about killing such spammers. If you actually tell them it's happening. – Michael Hampton Sep 26 '18 at 17:10
  • @MichaelHampton Thanks for the suggestion. I've sent them dozens of complaints and they've all been ignored, hence my giving up and going to this extreme. It blows me away that these guys, using the same domain and two Gmail accounts, have been getting away with this for almost a year now. – CraigH Sep 26 '18 at 22:29
  • I wound up here with exactly the same problem. As of today, Amazon says, " Hello, Thank you for submitting your report to AWS Abuse. In reviewing your report, we can see that it concerns the AWS SES service. This can be seen in the header you provided as it contains a URL ending in amazonses.com. We have forwarded your report to that team for further investigation. For faster resolution we recommended sending all cases containing amazonses.com in the header to email-abuse@amazon.com. All other reports should continue to be sent to ec2-abuse@amazon.com. Thank you, AWS Abuse Team" – Bill McGonigle Jan 18 at 0:53
2

Just to show that the suggestion feature when you enter a subject works, when I entered the subject for this question the first result was a link to Route mail in postfix to different relays based on subject. It's not what I was looking for, but it led me to look more closely at header_checks despite what is stated in the answer at the link in my question. A web search led me to How to filter mail with postfix header_checks, which was the answer I was looking for.

In my case this worked in /etc/postfix/header_checks:

/^From:.*partyfixx/ REJECT

I actually put a very rude message after "REJECT", but that's not appropriate to include here.

Here is the log entry for their most recent attempt:

Sep 25 01:41:54 mymailserver postfix/cleanup[19112]: F2A6428C3FD: reject: header From: The Party Fixx Company <ThePartyFixxCompany@gmail.com> from a9-98.smtp-out.amazonses.com[54.240.9.98]; from=<010001660e63cb43-c865ad08-e534-4fbd-acbe-ba6fed55ed25-000000@amazonses.com> to=<me@example.com> proto=ESMTP helo=<a9-98.smtp-out.amazonses.com>: 5.7.1 Rude message redacted!!!

The regex is case insensitive.

Other answers I found useful:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.