What's the FASTEST way to filter postqueue mails by sender IP address?

1

I maintain a mail server used by hundreds of customers. Now and then a customer gets infected by a virus and starts sending tons of spam email. I primarily notice this because it fills the post queue with tens of thousands of pending mails, rather than a couple of hundred.

Finding the spam sender's IP address and blocking it is simple, but I still have tens of thousands of spam emails in the mail queue, often with different sender addresses.

When I print the post queue using postqueue -p it displays the mail ID, the sender email address and all recipients. It doesn't display the IP of the sender.

I can find the sender IP of a mail by running:

postcat -q ABCDEF1234 | egrep "\\bclient_address="

Where "ABCDEF1234" is the mail ID.

I wrote a tool that lists all mail IDs, then loops through them running postcat -q on each one and filtering away those that don't match the input ID.

This works, but it's extremely slow. Filtering a post queue with 441 emails takes 7-8 seconds. If I'm trying to filter a spam-filled post queue with tens of thousands of mails, this tool is going to be useless.

My hope is that there is some tool or flag I don't know about that let's me filter by sender IP address.


I'm running Postfix 2.10

Hubro

Posted 2017-05-28T05:26:07.493

Reputation: 4 846

No answers