0

For some time now I receive a lot of spam emails. The emails are all different but if I lookup the domain of the email address it always resolves to the same IP address.

So:

  • xyz@domain1.tld -> resolves to 80.249.161.131
  • ddfda@domain2.tld -> resolves to 80.249.161.131
  • etc.

In postfix I can reject each email address but in this case it is not helpful because the email address changes all the time.

The next problem I have is that each email is send through a different mail server. So I cannot block by sender address.

What I would like to do is block an email by the ip address. Not that of the sender but of the ip address of the domain used as part of the email.

Any suggestions on how this is done in postfix?

  • 1
    Is it really so that all the domains resolve to the same IP address, but the messages are coming from different sources? That's unusual. – Esa Jokinen Jun 22 '19 at 10:13
  • Yes, however, the domain name of the mail server also resolves to the same ip address. But the subdomain provided with the HELO points to a different ip address, which is the same address used to contact my mail server. – Jeroen Gremmen Jun 23 '19 at 17:28
  • Couldn't you just block the offending IP address? – Esa Jokinen Jun 23 '19 at 20:08
  • Well that was my question. Blocking 80.249.161.131 doesn't work because the mails do not come from that ip address. So how do I block those emails? – Jeroen Gremmen Jun 24 '19 at 19:46
  • That's why it's better to block the actual source IP addresses. – Esa Jokinen Jun 24 '19 at 20:08
0

I believe this is what you are looking for: http://www.postfix.org/postconf.5.html#check_sender_a_access

Add

smtpd_sender_restrictions = check_sender_a_access hash:/etc/postfix/sender_a_access

in your main.cf

and add

80.249.161 REJECT

in your /etc/postfix/sender_a_access

and call

postmap /etc/postfix/sender_a_access

This will block the whole /24 subnet from that ip range where a lot of spam comes from.

I also use this for exactly the same ip range ;).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.