1

I'm having a problem with sending bounces to spammers when a remote "trusted" smtp server rejects a mail. My server manages mail for company1.com that has a virtual alias support@company1.com that delivers mail to a bunch of local users but also to the support@company2.com that is managed by the other team. Their mail system implements a different (better if you will) spam protection and can reject mails after DATA.

The problem is when a spammer reaches through and postfix on company1.com mail server tries to deliver mail to support@company2.com it gets

 554 Transaction failed. Unacceptable content. (in reply to end of DATA command)

and generates a bounce message to the spammer. So the question is how do I prevent it from doing that? In fact I'm not interested in generating any bounce messages for company2.com at all so a large hammer would work too since my mail server doesn't handle any other mail for company2.com.

Thanks in advance.

Mike
  • 11
  • 1

1 Answers1

0

Since you can't really prevent NDRs, I can only propose a workaround which is far from perfect:

Route mail to @company2.com through a dedicated smtp client - transport_maps will do that for you - and specify a regexp/pcre map in master.cf for this transport that rewrites the sender address, i.e. if the mail is from spammer@example.com, you rewrite it to spamsink+spammer=example.com@company1.com. Bounces will be delivered to the spamsink@company1.com mailbox. The downside is that support@company2.com will either need to rewrite the addresses again or won't ever see the real sender.

The standard answer to this would be to make sure that UCE/UBE policies on your gateway and the company2.com gateway are the same, or that your relay is whitelisted by company2.com (they'd need to quarantine/deal with spam themselves, then).

Stefan Förster
  • 1,141
  • 5
  • 8
  • Thanks for taking your time to reply. It confirms my findings. Unfortunately I can't easily implement either of your suggestions. The other side is being a commercial proxy firewall that has limited configuration capabilities. But I'll see what I can do. Thanks again. – Mike Sep 09 '13 at 12:18