{"id":5235,"date":"2015-10-04T13:29:14","date_gmt":"2015-10-04T05:29:14","guid":{"rendered":"http:\/\/rmohan.com\/?p=5235"},"modified":"2015-10-04T13:29:14","modified_gmt":"2015-10-04T05:29:14","slug":"postfix-blocking-spam-before-it-enters-the-server","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=5235","title":{"rendered":"Postfix – Blocking spam before it enters the server"},"content":{"rendered":"

Postfix – Blocking spam before it enters the server
\n<\/strong>
\nPosted in DNSBL E-mail E-mail spam Extended SMTP Mail transfer agents Postfix Spam filtering
\nWhen i first setup the server part 1 and part 2 i used the basic setting for postfix but soon found that i could reduce the amount of spam and load on the server by rejecting it before accepting it, i will do this by forcing mail servers that wanna deliver mail to me to be configured correctly and by using a few RBL (Real-time Blacklists).<\/p>\n

Since i use Webmin i just navigate to “servers”, “Posfix Mail server” then click “Edit Config Files” or manually edit “\/etc\/postfix\/main.cf”<\/p>\n

Below is my new config file – obviously change the IP’s to your IP’s and the domains to yours.<\/p>\n

########################################################
\ninet_protocols = all
\ninet_interfaces = 127.0.0.1, 192.168.0.200, [2001:470:1f09:d2b::220], [::1]
\nsmtp_bind_address = 192.168.0.200
\nsmtp_bind_address6 = [2001:470:1f09:d2b::220]
\nmyorigin = $mydomain
\nmynetworks = 127.0.0.0\/8, 192.168.0.200, [2001:470:1f09:d2b::\/64], [::1\/128]
\nmyhostname = mail.example.com
\nmydomain = example.com
\nmydestination = $myhostname, $mydomain, localhost.$mydomain, localhost<\/p>\n

virtual_alias_domains = example.co.uk, example2.com, example3.com, example2.co.uk
\nvirtual_alias_maps = hash:\/etc\/postfix\/virtual<\/p>\n

smtpd_delay_reject = yes
\nsmtpd_helo_required = yes
\nsmtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_hostname, reject_invalid_hostname, permit<\/p>\n

smtpd_sender_restrictions =permit_sasl_authenticated, permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit<\/p>\n

smtpd_recipient_restrictions = permit_mynetworks, permit_inet_interfaces, permit_sasl_authenticated, reject_unauth_pipelining, reject_invalid_hostname, reject_non_fqdn_hostname, reject_unknown_recipient_domain, reject_unauth_destination, reject_rbl_client dnsbl.sorbs.net, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit<\/p>\n

policyd-spf_time_limit = 3600
\nsmtpd_client_restrictions = permit_tls_all_clientcerts, reject_unauth_pipelining<\/p>\n

2bounce_notice_recipient = webmaster@example.com
\nerror_notice_recipient = webmaster@example.com
\nbounce_notice_recipient = webmaster@example.com<\/p>\n

smtpd_sasl_local_domain =
\nsmtpd_sasl_auth_enable = yes
\nbroken_sasl_auth_clients = yes
\nsmtpd_sasl_authenticated_header = yes
\nsmtpd_tls_key_file = \/etc\/postfix\/ssl\/key.pem
\nsmtpd_tls_cert_file = \/etc\/postfix\/ssl\/mail.example.com.pem
\nsmtpd_tls_CAfile = \/etc\/postfix\/ssl\/sub.class1.server.ca.pem
\nsmtpd_error_sleep_time = 5s<\/p>\n

smtp_use_tls = yes
\nsmtpd_tls_auth_only = no
\nsmtp_tls_note_starttls_offer = yes
\nsmtpd_use_tls = yes
\nsmtpd_tls_loglevel = 1
\nsmtpd_tls_received_header = yes
\nsmtpd_tls_session_cache_timeout = 3600s<\/p>\n

tls_random_source = dev:\/dev\/urandom
\ndisable_vrfy_command = yes
\nunknown_client_reject_code = 550
\nunknown_hostname_reject_code = 550
\nunknown_address_reject_code = 550<\/p>\n

some people might say this is quite restrictive as it will block any mail server that is mis-configured or using a dynamic ip, or been blocked for sending spam but i have found it blocks 95% of the spam i was receiving beforehand without using a spam filter (thus reducing the load on the server) and i haven’t seen any downsides as all legit mail is getting through fine.<\/p>\n

I’ll try and explain what the main changes are. There are 3 main sections I changed “smtpd_helo_restrictions”, “smtpd_sender_restrictions” and “smtpd_recipient_restrictions”<\/p>\n

smtpd_sender_restrictions =permit_sasl_authenticated, permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit
\nThis allows my networks and users that have authenticated themselves to connect but blocks any servers that haven’t configured a valid hostname for there mail server (should always use a proper domain name i.e. myhostname = mail.example.com) and also stops people trying to relay mail through my server.<\/p>\n

smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_hostname, reject_invalid_hostname, permit
\nWhen mail servers communicate with each other they say hello and identify themselves, this setting allows my networks to connect but blocks any servers that haven’t configured a valid hostname for there mail server (should always use a proper domain name i.e. myhostname = mail.example.com)<\/p>\n

smtpd_recipient_restrictions = permit_mynetworks, permit_inet_interfaces, permit_sasl_authenticated, reject_unauth_pipelining, reject_non_fqdn_hostname, reject_unknown_recipient_domain, reject_unauth_destination, reject_invalid_hostname, reject_rbl_client dnsbl.sorbs.net, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit
\nThis setting does the same as the above commands except it rejects mail servers that have been listed on RBL (Real-time Blacklists) you can google for more RBL lists but these do just fine for me.
\nI use dnsbl.sorbs.net, zen.spamhaus.org and bl.spamcop.net<\/p>\n

If you want a more detailed explanation of what each option does have a read of Postfix Configuration Parameters it lists every option going.<\/p>\n

I have also setup SPF checking and a white-list just in-case a valid email server gets on the RBL list. SPF can be studied in previous article.<\/p>\n","protected":false},"excerpt":{"rendered":"

Postfix – Blocking spam before it enters the server Posted in DNSBL E-mail E-mail spam Extended SMTP Mail transfer agents Postfix Spam filtering When i first setup the server part 1 and part 2 i used the basic setting for postfix but soon found that i could reduce the amount of spam and load on […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5235"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5235"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5235\/revisions"}],"predecessor-version":[{"id":5236,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5235\/revisions\/5236"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}