On 17/11/10 7:26 AM, Rob Kampen wrote:

...

...

Examining the postfix queue with postqueue -p: I see many (Host or domain name not found. Name service error for name=bdgiedjhea.po6e4ina.com type=MX: Host not found, try again) Jake@bdgiedjhea.po6e4ina.com My question - why does this stay in the message queue - why not dumped back with message undeliverable or dropped?

What is the complete output of postqueue -p? What is the From address and, more to the point, is it MAILER-DAEMON?

Agreed, however this opens a potential DoS attack vector - I'm trying to determine why my postfix even has these requests present as I'm not initiating the emails (as far as I know) and I do not forward emails for any other domains. I feel like I'm missing something......confused maybe

It could be backscatter.

Run postqueue -p and pick one of the messages, it shouldn't matter which. Then run:

postcat -q $MSGID | less

Where $MSGID is one of the messages in the queue. That will show you the message and headers. I'd be willing to bet it's your server trying to send a rejection/spam detection to a server.

Regards, Ben

Pls add bdgiedjhea.po6e4ina.com Jake@bdgiedjhea.po6e4ina.com to /etc/hosts file

and , then add bdgiedjhea.po6e4ina.com Jake@bdgiedjhea.po6e4ina.com to mydestination parameter in /etc/postfix/main.cf file

mydestination = $myhostname, localhost.$mydomain, localhost, bdgiedjhea.po6e4ina.com Jake@bdgiedjhea.po6e4ina.com

then, restart postfix.

That't it.

On Mon, Nov 22, 2010 at 9:17 AM, Rob Kampen rkampen@kampensonline.comwrote:

Ben McGinnes wrote:

...

On 17/11/10 7:26 AM, Rob Kampen wrote:

...

Examining the postfix queue with postqueue -p: I see many

...

...

(Host or domain name not found. Name service error for name=bdgiedjhea.po6e4ina.com type=MX: Host not found, try again) Jake@bdgiedjhea.po6e4ina.com My question - why does this stay in the message queue - why not dumped back with message undeliverable or dropped?

What is the complete output of postqueue -p? What is the From address and, more to the point, is it MAILER-DAEMON?

Yes it is

...

...

Agreed, however this opens a potential DoS attack vector - I'm trying to determine why my postfix even has these requests present as I'm not initiating the emails (as far as I know) and I do not forward emails for any other domains. I feel like I'm missing something......confused maybe

It could be backscatter.

Run postqueue -p and pick one of the messages, it shouldn't matter which. Then run:

postcat -q $MSGID | less

Where $MSGID is one of the messages in the queue. That will show you the message and headers. I'd be willing to bet it's your server trying to send a rejection/spam detection to a server.

Correct - thanks for the pointers on how to track it down - so now my question is how do I set things up to simply try this once and then drop it, rather than queue it up for the next five days with all the attendant dns errors. This is definitely at the boundaries of my mail setup experience - for some reason the other two mail servers I run do not seem to get the same level of spam and thus I seldom notice this.

...

Regards, Ben

---

---

CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

---

CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

On 22/11/10 2:47 PM, Rob Kampen wrote:

Ben McGinnes wrote:

...

What is the complete output of postqueue -p? What is the From address and, more to the point, is it MAILER-DAEMON?

Yes it is

Cool.

...

Where $MSGID is one of the messages in the queue. That will show you the message and headers. I'd be willing to bet it's your server trying to send a rejection/spam detection to a server.

Correct - thanks for the pointers on how to track it down -

No problem.

so now my question is how do I set things up to simply try this once and then drop it, rather than queue it up for the next five days with all the attendant dns errors.

That would be difficult to do without it affecting all mail and resolution problems are supposed to induce temporary failures for a reason. The reason normally being that if you are isolated from the Internet for any length of time (e.g. link outage), you don't want mail queued on the server being bounced or dropped because you can't reach an external name server to find an A record or MX record.

This is definitely at the boundaries of my mail setup experience - for some reason the other two mail servers I run do not seem to get the same level of spam and thus I seldom notice this.

Are they both running Postfix too? If so, compare the output of postconf -n between the three servers and look for what is different.

In this case, the email address that the bounces are trying to be delivered to is what appeared in the MAIL FROM section during delivery. It is almost certainly intended to bounce and the mail will all be spam. I haven't been able to find any A records for that domain and the registration is in Russia. It's a fairly safe bet that they're spammers.

I would recommend that you add the following to your smtpd_recipient_restrictions in main.cf:

check_sender_access hash:/etc/postfix/sender_access,

Probably immediately above or below the line for "check_recipient_access" which is listed in your original post.

Create a file called /etc/postfix/sender_access with the text editor of your choice and include the following line:

po6e4ina.com REJECT

Then run the following commands:

postmap /etc/postfix/sender_access postfix reload

That should do the trick nicely.

Regards, Ben

Am 26.11.2010 19:48, schrieb Mike Fedyk:

On Tue, Nov 16, 2010 at 11:49 AM, Rob Kampen rkampen@kampensonline.com wrote:

...

Hi list, I have noted over the last week or so my DNS servers are dumping lots of messages for bogus domain lookups. Examining the postfix queue with postqueue -p: I see many (Host or domain name not found. Name service error for name=bdgiedjhea.po6e4ina.com type=MX: Host not found, try again) Jake@bdgiedjhea.po6e4ina.com My question - why does this stay in the message queue - why not dumped back with message undeliverable or dropped? I understand this is probably related to my config - which follows: <main.cf>

Here's what you want (copied from my config):

Not really - because the shown part of the Postfix config is doubtful.

maps_rbl_reject_code = 450 non_fqdn_reject_code = 450

Why a temporary DSN? You want those to come back again and again and again ...?

smtpd_delay_reject = yes

Running the default of a delayed reject, why then splitting up the smtpd_*_restrictions causing plenty of tests to be run more than 1 time?

smtpd_helo_required = yes

smtpd_helo_restrictions = reject_unauth_pipelining permit_sasl_authenticated permit_mynetworks reject_invalid_hostname reject_non_fqdn_hostname

Can lead to a lot of rejects for legitimate senders.

    reject_unknown_helo_hostname
    permit

smtpd_sender_restrictions = reject_unauth_pipelining reject_non_fqdn_sender reject_non_fqdn_recipient

Again in smptd_recipient_restrictions.

    reject_unknown_recipient_domain

Again in smptd_recipient_restrictions.

    reject_unknown_sender_domain
    permit

smtpd_client_restrictions = # sleep 1 reject_unauth_pipelining permit_sasl_authenticated permit_mynetworks reject_unknown_client_hostname permit

smtpd_recipient_restrictions = reject_unauth_pipelining reject_non_fqdn_recipient reject_unknown_recipient_domain permit_mynetworks permit_sasl_authenticated reject_unauth_destination #fully automated RBLs

Much too much RBLs, really.

    reject_rbl_client truncate.gbudb.net
    reject_rbl_client dnsbl.proxybl.org
    reject_rbl_client psbl.surriel.com
    reject_rbl_client db.wpbl.info
    reject_rbl_client bl.spamcop.net

spamcop can be too aggressive.

# reject_rbl_client bl.spamcannibal.org #blocked charles reject_rbl_client intercept.datapacket.net reject_rbl_client spamtrap.drbl.drand.net # reject_rbl_client dnsbl.ahbl.org #blocked godaddy reject_rbl_client dnsbl-1.uceprotect.net reject_rbl_client bhnc.njabl.org reject_rbl_client dnsbl.njabl.org #larder RBLs with some non-automation and larger ranges of IPs # reject_rbl_client dnsbl.sorbs.net #(blocked fedora) # reject_rbl_client dnsbl-2.uceprotect.net reject_rbl_client dnsbl-3.uceprotect.net reject_rbl_client zen.spamhaus.org # reject_rbl_client # reject_rbl_client dnsbl-2.uceprotect.net, # check_policy_service unix:private/spfpolicy # check_policy_service inet:127.0.0.1:10023 permit

strict_rfc821_envelopes = yes smtpd_reject_unlisted_sender = yes

Alexander