Re: Postfix Double Bounce Handling

--Apple-Mail=_555AD88D-7299-4E8B-ADC3-A4D10465C53C
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=iso-8859-1

Thanks for your quick response Michael,

But I don't understand what can make my server a backscatter source.

I'm not relaying from outside, and I only accept messages from my =
domain, and only from my aging sendmail+dovecot server, so no relaying =
from outside.

What I don't have is what you said: check for local recipients. But this =
is a problem?

Thanks in advance,

On May 14, 2012, at 2:22 PM, Michael Orlitzky wrote:

> On 05/14/12 12:38, Vin=EDcius Ferr=E3o wrote:
>> Hello,
>>=20
>> I'm running a postfix mail filtering gateway in a hardened gentoo box
>> and I really don't know what to do with double-bounced messages.
>>=20
>> Since we have a lot of spam bots attacking our infrastructure, the
>> double bounce messages cannot be ignored and mail mail queue is =
growing
>> with undeliverable double bounce messages.
>>=20
>> Any thoughts on what should be done to handle this?
>>=20
>=20
> If you are accepting mail for addresses that don't belong to you, =
stop!
> That makes you a backscatter source, and will eventually (rightly) get
> you blacklisted.
>=20
> You said it's a mail filtering gateway... Usually the reason people
> backscatter on a gateway is because "it's hard" to get a list of all
> valid recipients; usually those recipients are on some other mail
> server. There are ways to do it, though, and you must, e.g.
>=20
>  a) Run a cron job that pulls valid accounts every hour.
>=20
>  b) Store the email accounts in a database, and allow the gateway to
>     query the database to determine which users are valid.
>=20
>  c) Use recipient verification[1]. When receiving mail, your gateway
>     can open a connection to the real mail server in the background,
>     and see if the recipient is valid.
>=20
>=20
> We use a combination of all three. We use (a) for an old Windows box,
> (b) for users stored in Dovecot, and (c) for customers with their own
> Exchange servers.
>=20
> If you ask over on postfix-users and provide the output of `postconf
> -n`, there are plenty of people who are able to give you tips relevant
> to your specific configuration.
>=20
>=20
> [1] http://www.postfix.org/ADDRESS_VERIFICATION_README.html#recipient
>=20
>=20


--Apple-Mail=_555AD88D-7299-4E8B-ADC3-A4D10465C53C
Content-Disposition: attachment;
	filename=smime.p7s
Content-Type: application/pkcs7-signature;
	name=smime.p7s
Content-Transfer-Encoding: base64

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIF2DCCBdQw
ggS8oAMCAQICAgR4MA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNVBAYTAkJSMQ8wDQYDVQQKDAZJQ1BF
RFUxFjAUBgNVBAoMDVVGRiBCckdyaWQgQ0ExMzAxBgNVBAMMKlVGRiBCcmF6aWxpYW4gR3JpZCBD
ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTA1MTcyMjAzMzZaFw0xMjA1MTYyMjAzMzZaMGwx
CzAJBgNVBAYTAkJSMQ8wDQYDVQQKEwZJQ1BFRFUxFjAUBgNVBAoTDVVGRiBCckdyaWQgQ0ExDTAL
BgNVBAoTBFVGUkoxCzAJBgNVBAsTAklGMRgwFgYDVQQDEw9WaW5pY2l1cyBGZXJyYW8wggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQComzM7hsXypIn2bBPvrhJHTMs+bFg0a/uxO7XVHFlp
pP0HW0F/NL9d0RtruB2F2jEhU1F6Mg0K6iqWORXbVn8g0FZNupFaVTdH6UOrrZSWa4ZJUfaGkRRH
QumOKjAH8Uijxynr2x5tcrm5NccLVkSGS53oCO14X1+qxihqW0UHtIKQcTHcneZX9GidtDgturyF
YX5whE5feVDCQFN2N7XFHw0vQvPtsH/CvPKldCc4n6Yx8v+hagpTG/FzelGo8m70M2aVibRywLYg
TYKEEAkEs2WdjKmLHr9Svmiv/YBOIOxA5Z69Vs3N9DmCLsamoCSDaV3fRU1YPeiUfQ31VyE1AgMB
AAGjggJ/MIICezAMBgNVHRMBAf8EAjAAMBEGCWCGSAGG+EIBAQQEAwIEsDAOBgNVHQ8BAf8EBAMC
BPAwMQYDVR0lBCowKAYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDAwYIKwYBBQUHAwgwTgYJ
YIZIAYb4QgENBEEWP0NQL0NQUyBWZXJzaW9uIDEuMCAtIFVGRiBCcmF6aWxpYW4gR3JpZCBDZXJ0
aWZpY2F0aW9uIEF1dGhvcml0eTAdBgNVHQ4EFgQUuauxpvs7K3wHCT4WZo1clfG4mWowgZUGA1Ud
IwSBjTCBioAUSnKLs/yMeVlnj18gJDjTj8p/ddahb6RtMGsxCzAJBgNVBAYTAkJSMQ8wDQYDVQQK
DAZJQ1BFRFUxFjAUBgNVBAoMDVVGRiBCckdyaWQgQ0ExMzAxBgNVBAMMKlVGRiBCcmF6aWxpYW4g
R3JpZCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eYIBADAnBgNVHREEIDAegRx2aW5pY2l1c2ZlcnJh
b0BjYy5pZi51ZnJqLmJyMB0GA1UdEgQWMBSBEmJyZ3JpZGNhQGljLnVmZi5icjA2BglghkgBhvhC
AQQEKRYnaHR0cDovL2JyZ3JpZGNhLmljLnVmZi5ici9jcmwvY2FjcmwuY3JsMDYGCWCGSAGG+EIB
AwQpFidodHRwOi8vYnJncmlkY2EuaWMudWZmLmJyL2NybC9jYWNybC5jcmwwOAYDVR0fBDEwLzAt
oCugKYYnaHR0cDovL2JyZ3JpZGNhLmljLnVmZi5ici9jcmwvY2FjcmwuY3JsMBwGA1UdIAQVMBMw
EQYPKwYBBAGBwgcCAQoBAQEAMA0GCSqGSIb3DQEBBQUAA4IBAQBEA8gsyZGx3wTn9XmRkzWeK9nn
ZXeGSiHgp9lZ47Z19dmUdVAT9SjyXasFT9IOSy1xhMVwrkD8Cn9cjyoSO8TACuUig3yslyS1vdFg
33xohX2Bj/mD2cmUJEL4mfars93OLDN1PZJH/tKtFGvI7xZje4q4ZC/Cme//jzQCI6+1C9zpkGdE
sOo8bIh7Iqw9gzrrH5hFnsuVyurPPm4CjdBMlFu0XDBI2C57CH7A1Em+nm7TeYGnSooDxYuSxxwm
tPtVVcBfCf8ZVtKNNc3VtRDRMnK9J0N5eH0s3Uljd+R3XUHxpCJl36y1oRhxkgou5XbRaZistxmP
wUqhtsIpSlENMYIDATCCAv0CAQEwcTBrMQswCQYDVQQGEwJCUjEPMA0GA1UECgwGSUNQRURVMRYw
FAYDVQQKDA1VRkYgQnJHcmlkIENBMTMwMQYDVQQDDCpVRkYgQnJhemlsaWFuIEdyaWQgQ2VydGlm
aWNhdGlvbiBBdXRob3JpdHkCAgR4MAkGBSsOAwIaBQCgggFlMBgGCSqGSIb3DQEJAzELBgkqhkiG
9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEyMDUxNDE4NDg1NFowIwYJKoZIhvcNAQkEMRYEFCyLe8eH
YY6kXlLNc2lAuq2w+NXbMIGABgkrBgEEAYI3EAQxczBxMGsxCzAJBgNVBAYTAkJSMQ8wDQYDVQQK
DAZJQ1BFRFUxFjAUBgNVBAoMDVVGRiBCckdyaWQgQ0ExMzAxBgNVBAMMKlVGRiBCcmF6aWxpYW4g
R3JpZCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQICBHgwgYIGCyqGSIb3DQEJEAILMXOgcTBrMQsw
CQYDVQQGEwJCUjEPMA0GA1UECgwGSUNQRURVMRYwFAYDVQQKDA1VRkYgQnJHcmlkIENBMTMwMQYD
VQQDDCpVRkYgQnJhemlsaWFuIEdyaWQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkCAgR4MA0GCSqG
SIb3DQEBAQUABIIBAC4ABzOM+m1sfJ6f7RRakQY+lXGX7gLG2HdPLWb//PaFDOt7hdstrEgjTstd
/1h9egJdP+Q8Aqwbm22RJAEpdsJByCal0mNZvsaS5EBQgBQLf6uk5ofDjn8dMikyhIdvLLds2H0Q
yOjdL0C866bVJk3ry0J1/7VIu+hCXUkcpzws2PGok14VZfTnDuv9DUHZTSQT9EvJErSLNx3Mml7J
B9kCk2WTB7gtHDwoeXrOwelLHFX6PQoKRBu1zcmWyWDfWiJgE35uTa7fG7q43Tc1dGR9+zoJAaQt
HZuBK6wIc6y7oKB/J4qk09xjQa6Xa/JkExOGHehocpQ7xFRGgt2TssEAAAAAAAA=

--Apple-Mail=_555AD88D-7299-4E8B-ADC3-A4D10465C53C--