Blocking backscatter spam in Postfix at the SMTP stage
Refuse with an error code, never bounce.
- Answers
- How do you stop a Postfix server from sending backscatter spam?
- Topics
- cloud · cyber-security · howto · linux · networking · server
- Full article on willem.com
- https://willem.com/en/2019-09-10_fighting-backscatter-spam-at-server-level/
Summary
Reject suspicious messages during the initial SMTP connection with an error code instead of accepting and bouncing them later. In Postfix that means stringent smtpd restrictions in main.cf, ordered from cheap checks to expensive ones.
Full text
My Postfix server on Debian got listed on the backscatterer.org blacklist despite requiring authentication for every user. The cause was forwarding: messages a stricter downstream filter refused were bounced back to forged senders. The only full cure is to be very stringent at the first mail server, at the initial SMTP connection stage, so that little gets accepted that could later bounce. In main.cf you specify SMTP restrictions that block messages outright. Order the filter logic from easy to hard, starting with checks that need no external servers: that reduces network traffic and load. Only a message that passes all checks is permitted for delivery or forwarding. Heavier, user specific filtering with SpamAssassin or Bayes filters still runs at delivery, and it works far more efficiently once the obvious spam is already refused at the door.