Prev: Selective alias depending on FROM?
Next: UTF-8 Subject Logging
From: Michael Weissenbacher on 7 Apr 2010 05:29
Hi List!
I am having the problem that our Postfix Mail Server generates too many
bounces which unfortunately results in getting listed (at least at
backscatterer.org). Having digged deepter into the problem i already
read and followed [1] as well as the obvious stuff like correct
local_recipient_maps. The problem i now have is like the following:
- our server accepts mail for localuser(a)localdomain.com
- there is a entry in /etc/postfix/virtual that forwards this mail to
foreignuser(a)foreigndomain.com (which is a legitemate destination and
usually accepts mails without a problem)
- the foreign server detects spam or a virus and rejects the delivery, i
get an entry in mail.log like:
status=bounced (host email.foreigndomain.com[1.2.3.4] said: 554 mail
server rejected message: spam or virus detected (#5.3.0) (in reply to
end of DATA command)
- our server of course then generates a bounce to a fake sender which
either fails because the sender doesn't exist or it triggers some spam trap

I've basically got 2 solutions in mind but i'm unsure on how to
implement them (or if they even make sense):
- It it possible to not generate bounces which go to external
destinations at all. Can i define anywhere that bounces may only go to
known local users?
- It it possible to send the bounces (or only external bounces) via an
alternate relayhost. That way i would prevent that our main smtp host's
ip is getting listed.

tia,
Michael

[1] http://www.postfix.org/BACKSCATTER_README.html

From: Michael Weissenbacher on 7 Apr 2010 06:09
>
> Do NOT forward mail to destinations that bounce mail. Either get the
> final destination to accept the forward mail or disable the forwarding
> when bounces are detected.
> Disable bounces is NOT a solution but making the problem worse.
>
Well, as i already said the destination usually DOES accept the forward
mail without problems. But there are some cases (like virus detected,
spam detected, mailbox full) when it rejects the forwarded mail. In that
case *my* server is generating the bounce. I cannot do anything at the
destination server(s) since they are not under my control.

cheers,
Michael

From: mouss on 7 Apr 2010 18:19
Michael Weissenbacher a écrit :
>> Do NOT forward mail to destinations that bounce mail. Either get the
>> final destination to accept the forward mail or disable the forwarding
>> when bounces are detected.
>> Disable bounces is NOT a solution but making the problem worse.
>>
> Well, as i already said the destination usually DOES accept the forward
> mail without problems. But there are some cases (like virus detected,
> spam detected, mailbox full) when it rejects the forwarded mail. In that
> case *my* server is generating the bounce. I cannot do anything at the
> destination server(s) since they are not under my control.
>

- configure your server to detect viruses and spam. In short, minimise
the case when your server passes mail that the remote server detects as
spam or virus.

- there will always be cases when your filter misses spam/viruses that
are detected by remote servers. This is not an issue unless it happens
too often.

- if it happens too often,
1- stop forwarding mail
2- see why it happens.

oh and forget about playing with bounces. The problem is not in bounce
generation and routing. It's in spam & virus forwarding.

From: ram on 8 Apr 2010 05:31

On Wed, 2010-04-07 at 11:59 +0200, lst_hoe02(a)kwsoft.de wrote:
> Zitat von Michael Weissenbacher <mw(a)dermichi.com>:
>
> > Hi List!
> > I am having the problem that our Postfix Mail Server generates too many
> > bounces which unfortunately results in getting listed (at least at
> > backscatterer.org). Having digged deepter into the problem i already
> > read and followed [1] as well as the obvious stuff like correct
> > local_recipient_maps. The problem i now have is like the following:
> > - our server accepts mail for localuser(a)localdomain.com
> > - there is a entry in /etc/postfix/virtual that forwards this mail to
> > foreignuser(a)foreigndomain.com (which is a legitemate destination and
> > usually accepts mails without a problem)
> > - the foreign server detects spam or a virus and rejects the delivery, i
> > get an entry in mail.log like:
> > status=bounced (host email.foreigndomain.com[1.2.3.4] said: 554 mail
> > server rejected message: spam or virus detected (#5.3.0) (in reply to
> > end of DATA command)


Find out why the host rejected the mail. I assume your mails are not
spam and they dont have a virus ( Email virus is almost a non-issue now
a days ) Are all the forwarded mails getting rejected , or only a few

I suspect the recipient server is doing an SPF check. So you wont be
able to forward unless you change the envelope.


Thanks
Ram

From: Michael Weissenbacher on 8 Apr 2010 08:43
Hi,
> Find out why the host rejected the mail. I assume your mails are not
> spam and they dont have a virus ( Email virus is almost a non-issue now
> a days ) Are all the forwarded mails getting rejected , or only a few
Well, i assume that those messages that get rejected (like 1 out of 10)
really contain spam or viruses since our frontend mailserver does only
some very brief spam checking and no virus checking due to load
restrictions. Usually we do those checks on our backend servers which
are configured to accept all mail.

> I suspect the recipient server is doing an SPF check. So you wont be
> able to forward unless you change the envelope.
The envelope is changed in our case as the destination address gets
rewritten.

Thanks for all your comments. I see now that we need to rework our
forwarding policy. I think the best solution will be to first relay
those mails to one of our backend servers, check them toroughly and only
then forward them externally.

cheers,
Michael

 | 
Pages: 1
Prev: Selective alias depending on FROM?
Next: UTF-8 Subject Logging