---
title: "Blocking backscatter spam in Postfix at the SMTP stage"
language: en
topics: ["cloud", "cyber-security", "howto", "linux", "networking", "server"]
full_article_url: https://willem.com/en/2019-09-10_fighting-backscatter-spam-at-server-level/
---
# Blocking backscatter spam in Postfix at the SMTP stage

*Refuse with an error code, never bounce.*

> Reject suspicious messages during the initial SMTP connection with an error code instead of accepting and bouncing them later. In Postfix that means stringent smtpd restrictions in main.cf, ordered from cheap checks to expensive ones.

My Postfix server on Debian got listed on the backscatterer.org blacklist despite requiring authentication for every user. The cause was forwarding: messages a stricter downstream filter refused were bounced back to forged senders. The only full cure is to be very stringent at the first mail server, at the initial SMTP connection stage, so that little gets accepted that could later bounce.
In main.cf you specify SMTP restrictions that block messages outright. Order the filter logic from easy to hard, starting with checks that need no external servers: that reduces network traffic and load. Only a message that passes all checks is permitted for delivery or forwarding.
Heavier, user specific filtering with SpamAssassin or Bayes filters still runs at delivery, and it works far more efficiently once the obvious spam is already refused at the door.