On 12/30/2011 11:31 AM, Stephen Atkins wrote: > > Here is the output of my postconf -n > > bounce_queue_lifetime = 2h
Instead of covering up the problem of a queue full of bounces, don't accept mail you aren't able to deliver. This usually means don't use wildcard aliases, do correctly populate the appropriate valid recipient maps. > content_filter = smtp-amavis:[127.0.0.1]:10024 Your content filter should never reject (bounce) unwanted mail. Make sure it's set to either tag or quarantine. > in_flow_delay = 5s Don't shoot yourself in the foot by randomly changing parameters. > local_recipient_maps = This must be set to a list of valid users or your queue will be filled with undeliverable bounces. http://www.postfix.org/LOCAL_RECIPIENT_README.html http://www.postfix.org/ADDRESS_CLASS_README.html > maximal_queue_lifetime = 1d That's unreasonably short; 3 days is considered the minimum, 5 days is the accepted standard. Usually a sign of trying to work around queue problems. > mynetworks = 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24, > 192.168.4.0/24, 192.168.5.0/24, 192.168.6.0/24, > 192.168.7.0/24, 209.91.64.21, 127.0.0.0/8, > 10.0.100.0/24, 10.0.6.0/24, 192.168.10.0/24, > 192.168.80.0/23, 192.168.142.0/24, 216.133.52.45, 216.113.43.184, > 192.168.143.0/24, 69.70.230.206, 207.96.243.24, 207.96.243.25, > 24.37.1.234, 10.0.0.0/8 Lots of networks, but OK. Make sure all the external IPs are ones you directly control. > smtpd_delay_reject = no This is usually a mistake. Leave this at the default "yes" unless you fully understand what it does and why. > smtpd_helo_restrictions = permit_mynetworks, > permit This is basically a no-op. Might as well remove it. > smtpd_recipient_restrictions = hash:/etc/postfix/access, > check_client_access hash:/etc/postfix/client_checks, > check_recipient_access hash:/etc/postfix/sender_checks, > check_sender_access hash:/etc/postfix/sender_checks, If you really are an open relay (not yet determined), the problem is likely in one of the maps listed above. It's very dangerous to use access maps before reject_unauth_destination. These should either be moved to smtpd_sender_restrictions or moved after reject_unauth_destination. http://www.postfix.org/SMTPD_ACCESS_README.html#danger > permit_mynetworks, permit_sasl_authenticated, > reject_non_fqdn_recipient, reject_unknown_recipient_domain, > reject_unauth_destination, reject_invalid_hostname, > check_client_access cidr:/etc/postfix/dnswl-header, > check_client_access cidr:/etc/postfix/dnswl-permit, > check_client_access hash:/etc/postfix/rbl_override, > reject_rbl_client zen.spamhaus.org, reject_rbl_client > combined.njabl.org, reject_rbl_client dbl.spamhaus.org, > check_policy_service inet:127.0.0.1:60000, permit OK. > smtpd_sender_restrictions = hash:/etc/postfix/access, Deprecated syntax. Use check_sender_access hash:/etc/postfix/access > check_client_access hash:/etc/postfix/client_checks, > check_sender_access hash:/etc/postfix/sender_checks, Looks like a lot of these are duplicated from smtpd_recipient_restrictions. No need to do them in both places. > permit_sasl_authenticated, permit_mynetworks, > reject_unauth_pipelining, permit > smtpd_tls_loglevel = 9 Using a tls loglevel above 1 is unlikely to give you any useful information, and will hide the important information in a flood of irrelevant drivel. > Dec 30 10:29:02 mta5 postfix/smtpd[3679]: E6F13186001: reject: RCPT from > unknown[113.94.89.26]: 554 5.7.1 <[email protected]>: Recipient address > rejected: 521; from=<[email protected]> to=<[email protected]> > proto=ESMTP helo=<nsizfwnsj> > > Dec 30 10:29:02 mta5 postfix/smtpd[3679]: E6F13186001: reject: RCPT from > unknown[113.94.89.26]: 554 5.7.1 <[email protected]>: Recipient > address rejected: 521; from=<[email protected]> > to=<[email protected]> proto=ESMTP helo=<nsizfwnsj> These are rejected and not useful to our discussion. Please show ALL the postfix logging of a suspect transaction that makes it to your queue. In particular, we want to see if there is a sasl_username= line logged for a suspicious QUEUEID. -- Noel Jones
