Posts tagged postfix

Postfix anti-spam configuration, December 2012

15

I’ve written a few posts on my Postfix anti-spam config, but since it’s been a while and I tweak it from time to time, here’s the config as of late December 2012:

smtpd_helo_restrictions =
        reject_non_fqdn_helo_hostname,
        reject_invalid_helo_hostname,
        reject_rhsbl_helo hostkarma.junkemailfilter.com=127.0.0.2,
        reject_rhsbl_helo zen.spamhaus.org

smtpd_data_restrictions =
        reject_unauth_pipelining

smtpd_client_restrictions =
        reject_rbl_client b.barracudacentral.org,
        reject_rbl_client hostkarma.junkemailfilter.com=127.0.0.2,
        reject_unknown_client_hostname

smtpd_sender_restrictions =
        reject_unknown_sender_domain,
        reject_unknown_address,
        reject_rhsbl_reverse_client dbl.spamhaus.org,
        reject_rbl_client b.barracudacentral.org

smtpd_recipient_restrictions =
        permit_mynetworks,
        reject_invalid_hostname,
        reject_non_fqdn_sender,
        reject_non_fqdn_recipient,
        reject_unknown_sender_domain,
        reject_unknown_recipient_domain,
        reject_unauth_destination,

        permit_dnswl_client list.dnswl.org,

        check_policy_service inet:127.0.0.1:10023,

        reject_rhsbl_reverse_client dbl.spamhaus.org,
        reject_rhsbl_sender dbl.spamhaus.org,
        reject_rhsbl_client dbl.spamhaus.org,
        reject_rhsbl_sender fresh15.spameatingmonkey.net,
        reject_rhsbl_client fresh15.spameatingmonkey.net,
        reject_rhsbl_sender uribl.spameatingmonkey.net,
        reject_rhsbl_client uribl.spameatingmonkey.net,
        reject_rhsbl_sender urired.spameatingmonkey.net,
        reject_rhsbl_client urired.spameatingmonkey.net,
        reject_rhsbl_client hostkarma.junkemailfilter.com=127.0.0.2,

        reject_rbl_client b.barracudacentral.org,
        reject_rbl_client zen.spamhaus.org,
        reject_rbl_client bl.spameatingmonkey.net,
        reject_rbl_client bl.spamcop.net,
        reject_rbl_client hostkarma.junkemailfilter.com=127.0.0.2,
        reject_rbl_client dnsbl.njabl.org,
        reject_rbl_client spamsources.fabel.dk,
        reject_rbl_client truncate.gbudb.net,
        reject_rbl_client ubl.unsubscore.com,
        reject_rbl_client aspews.ext.sorbs.net,
        reject_rbl_client dnsbl.sorbs.net,
        reject_rbl_client backscatter.spameatingmonkey.net,
        reject_rbl_client bl.spameatingmonkey.net,
        reject_rbl_client psbl.surriel.com,
        reject_rbl_client cidr.bl.mcafee.com,
        reject_rbl_client bl.mailspike.net,
        reject_rbl_client ix.dnsbl.manitu.net,
        reject_rbl_client black.uribl.com,
        reject_rbl_client spam.spamrats.com,

        permit

I had a string of spam making it into my mailbox recently which is why I added a few new RBLs to the config, but based on dnsblcount‘s report on the number of DNSBL rejections since the beginning of the month, I can probably trim it down a little (note that the DNSBLs are queried in the order listed in your config).

b.barracudacentral.org            6457
hostkarma.junkemailfilter.com     1513
dbl.spamhaus.org                  1110
fresh15.spameatingmonkey.net        35
zen.spamhaus.org                    17
dnsbl.webequipped.com                3
ubl.unsubscore.com                   3
spam.spamrats.com                    2
truncate.gbudb.net                   2
uribl.spameatingmonkey.net           1
psbl.surriel.com                     1
dnsbl.sorbs.net                      1
bl.mailspike.net                     1
=======================================
Total DNSBL rejections:            9146

Note one additional new item I added to my postfix config is the postgrey greylisting policy service (via the check_policy_service inet:127.0.0.1:10023).

More robust Postfix anti-spam configuration

0

My last post included an updated Postfix main.cf that was better at blocking spam and minimizing false positives through the use of DNS white lists (DNSWLs), but after a few days it was still letting in more spam than I wanted. I did additional tweaking and the following seems to work better, while still preventing false positives.

The main changes included specifying the following additional Postfix restrictions:

  • smtpd_sender_restrictions
  • smtpd_helo_restrictions
  • smtpd_data_restrictions
smtpd_helo_restrictions =
	reject_unknown_helo_hostname

smtpd_data_restrictions =
	reject_unauth_pipelining

smtpd_client_restrictions =
	permit_dnswl_client list.dnswl.org,
	reject_rbl_client b.barracudacentral.org,
	reject_rbl_client hostkarma.junkemailfilter.com=127.0.0.2,

smtpd_sender_restrictions =
	reject_unknown_sender_domain,
	reject_unknown_address,
	reject_rhsbl_sender dsn.rfc-ignorant.org,
	reject_rhsbl_reverse_client dbl.spamhaus.org,
	reject_rbl_client b.barracudacentral.org,

smtpd_recipient_restrictions =
	permit_mynetworks,
	reject_invalid_hostname,
	reject_non_fqdn_sender,
	reject_non_fqdn_recipient,
	reject_unknown_sender_domain,
	reject_unknown_recipient_domain,
	reject_unauth_destination,
	permit_dnswl_client list.dnswl.org,

	reject_rhsbl_reverse_client dbl.spamhaus.org,
	reject_rhsbl_sender dbl.spamhaus.org,
	reject_rhsbl_client dbl.spamhaus.org,
	reject_rhsbl_sender fresh15.spameatingmonkey.net,
	reject_rhsbl_client fresh15.spameatingmonkey.net,
	reject_rhsbl_sender uribl.spameatingmonkey.net,
	reject_rhsbl_client uribl.spameatingmonkey.net,
	reject_rhsbl_sender urired.spameatingmonkey.net,
	reject_rhsbl_client urired.spameatingmonkey.net,
	reject_rhsbl_client hostkarma.junkemailfilter.com=127.0.0.2,

	reject_rbl_client b.barracudacentral.org,
	reject_rbl_client zen.spamhaus.org,
	reject_rbl_client bl.spameatingmonkey.net,
	reject_rbl_client bl.spamcop.net,
	reject_rbl_client hostkarma.junkemailfilter.com=127.0.0.2,
	reject_rbl_client dnsbl.njabl.org,
	reject_rbl_client bl.tiopan.com,
	reject_rbl_client spamsources.fabel.dk,
	reject_rbl_client truncate.gbudb.net,
	reject_rbl_client ubl.unsubscore.com,
	reject_rbl_client aspews.ext.sorbs.net,
	reject_rbl_client dnsbl.sorbs.net,
	reject_rbl_client backscatter.spameatingmonkey.net,
	reject_rbl_client bl.spameatingmonkey.net,

	permit

12/1/2012 update: I removed reject_rhsbl_sender dsn.rfc-ignorant.org since it is no longer up as of 11/30/2012

Using DNS whitelists in Postfix

4

Update 7/21/2011: I’ve tweaked my main.cf config more recently that provided better results. I will have a follow-up post with the changes and additions.

In an earlier post several years back, I wrote about using DNS blacklists (DNSBLs) in postfix to block unwanted spam from hitting my inbox, and in the last week I tweaked it a bit to include DNS whitelists (DNSWLs). I was discovering that some of the DNSBLs were blocking a small portion of legitimate email from coming through (eg. blocking entire IP ranges for webmail providers).

You need Postfix 2.8 or higher (I was on 2.3.3 so I had to download and compile the latest, 2.8.3), which has a new configuration parameter which added support for querying a DNSWL like a DNSBL:

permit_dnswl_client dnswl_domain=d.d.d.d

The relevant portion of my updated Postfix main.cf is below (note permit_dnswl_client is inserted before any of the reject_rbl* parameters). The DNSWL queries are processed first before the DNSBLs, so it should allow legitimate IPs through and reduce the amount of false positives vs just using the DNSBLs alone.

smtpd_recipient_restrictions =
        permit_mynetworks,
        reject_invalid_hostname,
        reject_non_fqdn_sender,
        reject_non_fqdn_recipient,
        reject_unknown_sender_domain,
        reject_unknown_recipient_domain,
        reject_unauth_destination,
        permit_dnswl_client list.dnswl.org,
        reject_rbl_client b.barracudacentral.org,
        reject_rbl_client zen.spamhaus.org,
        reject_rbl_client bl.spameatingmonkey.net,
        reject_rbl_client bl.spamcop.net,
        reject_rbl_client hostkarma.junkemailfilter.com=127.0.0.2,
        reject_rbl_client dnsbl.njabl.org,
        reject_rbl_client bl.tiopan.com,
        reject_rbl_client spamsources.fabel.dk,
        reject_rbl_client truncate.gbudb.net,
        reject_rbl_client ubl.unsubscore.com,
        reject_rbl_client aspews.ext.sorbs.net,
        reject_rbl_client dnsbl.sorbs.net,
        reject_rbl_client backscatter.spameatingmonkey.net,
        reject_rbl_client bl.spameatingmonkey.net,
        reject_rhsbl_sender fresh15.spameatingmonkey.net,
        reject_rhsbl_client fresh15.spameatingmonkey.net,
        reject_rhsbl_sender uribl.spameatingmonkey.net,
        reject_rhsbl_client uribl.spameatingmonkey.net,
        reject_rhsbl_sender urired.spameatingmonkey.net,
        reject_rhsbl_client urired.spameatingmonkey.net,
        reject_rbl_client dnsbl.inps.de,
        reject_rbl_client DDNSBL.InternetDefenseSystems.com,
        permit

After watching the logs for the last couple days, this setup seems to work quite well…only 1 piece of spam slipped through, and more importantly, no false positives! I should also note that I stopped using spamassassin a while back and just these settings in postfix seems to block almost all legitimate spam coming into my server while not generating false positives.

BTW, if you want to tail your maillog from the command line in realtime and see the rejects in a more readable format, this short one liner will work:

$ tail -f /var/log/mail.log | sed -r -n 's/^(.*) \S+ postfix\/.* blocked using ([^;]+).*; from=<(\S+)> to=<(\S+)> proto=.* helo=.*>$/\1 - \2 - \3 - \4/p'

it will output in the format TIMESTAMP – DNSBL – FROM ADDRESS – TO ADDRESS

“file too large” error message in /var/log/maillog

0

I run Postfix as the mail transfer agent (MTA) on my server and saw a bunch of “error writing message: File too large” errors in /var/log/maillog as well as senders getting this bounce message:

I'm sorry to have to inform you that your message could 
not be delivered to one or more recipients. It's 
attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can 
delete your own text from the attached returned message.

                   The mail system

<example@example.com>: cannot update mailbox 
/var/mail/example for user example. error writing message:
File too large

Ends up that Postfix has a mailbox_size_limit setting & since I didn’t have that set, it was set to the default 50MB. The user’s mailbox was near that limit so I up’d the default to 150MB in /etc/postfix/main.cf:

mailbox_size_limit = 157286400

then reloaded postfix:

service postfix reload

and all was good again.

Go to Top