{
 "id": 69779,
 "slug": "blocking-backscatter-spam-in-postfix-at-the-smtp-stage",
 "url": "https://agents.willem.com/en/snippets/blocking-backscatter-spam-in-postfix-at-the-smtp-stage/",
 "language": "en",
 "title": "Blocking backscatter spam in Postfix at the SMTP stage",
 "subtitle": "Refuse with an error code, never bounce.",
 "summary": "Reject suspicious messages during the initial SMTP connection with an error code instead of accepting and bouncing them later. In Postfix that means stringent smtpd restrictions in main.cf, ordered from cheap checks to expensive ones.",
 "topics": [
  "cloud",
  "cyber-security",
  "howto",
  "linux",
  "networking",
  "server"
 ],
 "date": "2019-09-10",
 "published": "2019-09-10T00:00:00+02:00",
 "created": "2026-08-30T07:13:28.503000+02:00",
 "updated": "2026-08-30T07:16:53.099000+02:00",
 "full_article_url": "https://willem.com/en/2019-09-10_fighting-backscatter-spam-at-server-level/",
 "author": {
  "name": "Willem L. Middelkoop",
  "url": "https://willem.com"
 },
 "note": "A short distillation of a longer willem.com post. Not currently published on willem.com itself.",
 "answers_question": "How do you stop a Postfix server from sending backscatter spam?",
 "text": "My Postfix server on Debian got listed on the backscatterer.org blacklist despite requiring authentication for every user. The cause was forwarding: messages a stricter downstream filter refused were bounced back to forged senders. The only full cure is to be very stringent at the first mail server, at the initial SMTP connection stage, so that little gets accepted that could later bounce.\nIn main.cf you specify SMTP restrictions that block messages outright. Order the filter logic from easy to hard, starting with checks that need no external servers: that reduces network traffic and load. Only a message that passes all checks is permitted for delivery or forwarding.\nHeavier, user specific filtering with SpamAssassin or Bayes filters still runs at delivery, and it works far more efficiently once the obvious spam is already refused at the door.",
 "markdown_url": "https://agents.willem.com/en/snippets/blocking-backscatter-spam-in-postfix-at-the-smtp-stage/snippet.md"
}