I'm hoping for a bit of input on how best to protect the automatically generated list owner addresses on mailman. It's recently come to my attention that spammers are sending messages to addresses like listname-owner@example.com. As these are automatically generated by mailman, and pipe directly to mailman commands (which in turn generally just forwards them onto the list owner's actual email address), they bypass a lot of spam filtering configurations. This means that spam emails are effectively getting relayed through our server, with the resulting problems that you'd expect. (backscatter, loss of reputation, annoyed list owners)

I'm not worried about protecting the email lists themselves - only subscribers are allowed to post, and mail sent to them gets filtered by spamassassin as usual. It's the admin addresses that are the problem.

Mailman doesn't seem to provide any means of hooking these into spamassassin. I've read up on some slightly esoteric configurations to force them through spamassassin before processing them, but I've not seen one that I'm comfortable with. They require some combination of (a) reconfiguring the delivery pipeline for all mail on the server, (b) rejecting mail at the MTA stage based on spamassassin's metrics, and (c) changing some of mailman's internal files that aren't meant to be manually edited. I don't like (a) because it risks disrupting the rest of the mail system, which is currently working fine. The problem with (b) is that mail can just silently disappear in the case of a false positive. So far I've just been relying on (c) and commenting out the aliases that are getting spammed, but that's far from ideal. Changes may well get wiped out by an update of the mailman package, plus it rather defeats the point of having an owner address for people to contact if they're having difficulty with the list.

Background information: I've got mailman set up on a Debian Stretch server, backed by Postfix and SpamAssassin, all set up official Debian packages. I've been running mail servers for over a decade, so I have a fairly good idea what I'm doing, but this problem doesn't seem to have a good solution out there yet. All suggestions gratefully received!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.