Re: Assistance to protect from spam flood

2019-01-12 Thread Bill Cole
On 12 Jan 2019, at 15:58, Nick Howitt wrote: On 12/01/2019 16:42, @lbutlr wrote: On 12 Jan 2019, at 07:52, Nick Howitt wrote: Unfortunately I don't have access to the MX Backup service. It is provided by my DNS provider. Honestly, you should not have an MX server outside of your control.

Re: Assistance to protect from spam flood

2019-01-12 Thread John Fawcett
On 12/01/2019 21:58, Nick Howitt wrote: > > > On 12/01/2019 16:42, @lbutlr wrote: >> On 12 Jan 2019, at 07:52, Nick Howitt wrote: >>> Unfortunately I don't have access to the MX Backup service. It is >>> provided by my DNS provider. >> Honestly, you should not have an MX server outside of your

Re: postdrop user maps

2019-01-12 Thread Wietse Venema
Wietse Venema: > Pali Roh?r: > > Meanwhile I decoded postdrop protocol and come up with more easier > > solution: > > That is an internal protocol. Programs that depend on this > are NOT SUPPORTED and will break. Why not add the extra recipient on the SENDMAIL command line? Example: install

Re: postdrop user maps

2019-01-12 Thread Wietse Venema
Pali Roh?r: > Meanwhile I decoded postdrop protocol and come up with more easier > solution: That is an internal protocol. Programs that depend on this are NOT SUPPORTED and will break. Wietse

Re: postdrop user maps

2019-01-12 Thread Pali Rohár
On Saturday 12 January 2019 18:14:39 Viktor Dukhovni wrote: > > On Jan 12, 2019, at 6:02 PM, Pali Rohár wrote: > > > > Meanwhile I decoded postdrop protocol and come up with more easier > > solution: > > > > I renamed postdrop binary to postdrop.real and implemented simple > > postdrop wrapper

Re: postdrop user maps

2019-01-12 Thread Viktor Dukhovni
> On Jan 12, 2019, at 6:02 PM, Pali Rohár wrote: > > Meanwhile I decoded postdrop protocol and come up with more easier > solution: > > I renamed postdrop binary to postdrop.real and implemented simple > postdrop wrapper which reads stdin, injects "R" command and pass it to > postdrop.real

Re: postdrop user maps

2019-01-12 Thread Pali Rohár
On Saturday 12 January 2019 17:38:23 Viktor Dukhovni wrote: > > On Jan 12, 2019, at 5:31 PM, Pali Rohár wrote: > > > > If you mean external content filters, I wanted to avoid using them. > > Sometimes you need to bring out the sledgehammer. > > > And it is really possible for milter to get

Re: postdrop user maps

2019-01-12 Thread Viktor Dukhovni
> On Jan 12, 2019, at 5:31 PM, Pali Rohár wrote: > > If you mean external content filters, I wanted to avoid using them. Sometimes you need to bring out the sledgehammer. > And it is really possible for milter to get unix user who invoked > postdrop or sendmail wrapper? If yes, how? Because

Re: postdrop user maps

2019-01-12 Thread Pali Rohár
On Saturday 12 January 2019 16:48:24 Viktor Dukhovni wrote: > > On Jan 12, 2019, at 1:50 PM, Pali Rohár wrote: > > > > Is there any option for postdrop which may be equivalent to > > smtpd_sender_login_maps option used for sasl? > > No, because there's no workable way to reject local

Re: postdrop user maps

2019-01-12 Thread Viktor Dukhovni
> On Jan 12, 2019, at 1:50 PM, Pali Rohár wrote: > > Is there any option for postdrop which may be equivalent to > smtpd_sender_login_maps option used for sasl? No, because there's no workable way to reject local submission, so all you can do is accept and perhaps rewrite. Also any such

Re: Assistance to protect from spam flood

2019-01-12 Thread Benny Pedersen
Nick Howitt skrev den 2019-01-12 21:58: efficient way of blocking these messages? Can they be blocked earlier than smtpd_sender_restrictions? : check valid recipient BEFORE valid senders qq.com have SPF use it, if SPF is pass block this sender domain if its spam, report to qq.com and hope

Re: Assistance to protect from spam flood

2019-01-12 Thread Nick Howitt
On 12/01/2019 16:42, @lbutlr wrote: On 12 Jan 2019, at 07:52, Nick Howitt wrote: Unfortunately I don't have access to the MX Backup service. It is provided by my DNS provider. Honestly, you should not have an MX server outside of your control. If your server is routinely down for several

Re: Assistance to protect from spam flood

2019-01-12 Thread Allen Coates
On 12/01/2019 11:09, Nick Howitt wrote: > > Is there anything further I can do to cut down or stop this spam? Also are > there more effective blocks I can do to > lighten the load on the server and reduce traffic? > > Thanks, > > Nick If you are troubled by Chinese hosts, you might also

postdrop user maps

2019-01-12 Thread Pali Rohár
Hello! Is there any option for postdrop which may be equivalent to smtpd_sender_login_maps option used for sasl? I have postfix submission configured with -o smtpd_sender_restrictions=reject_sender_login_mismatch,permit -o smtpd_sender_login_maps=hash:/my/file to ensure that authenticated user

Re: Assistance to protect from spam flood

2019-01-12 Thread Bill Cole
On 12 Jan 2019, at 6:09, Nick Howitt wrote: I have a mail server and two backup MX servers and most of the mail is arriving via one of the backup servers. Your first step should be to seriously interrogate that architectural choice. When variable-priority MXs were devised, the Internet was

Re: Assistance to protect from spam flood

2019-01-12 Thread @lbutlr
On 12 Jan 2019, at 07:52, Nick Howitt wrote: > Unfortunately I don't have access to the MX Backup service. It is provided by > my DNS provider. Honestly, you should not have an MX server outside of your control. If your server is routinely down for several days, then you shouldn't be running

Re: Assistance to protect from spam flood

2019-01-12 Thread Durga Prasad Malyala
Hi, if you implement Mailscanner etc you can assign a higher score based on a header containing 163.com. Maybe that would work. In any case everyone uses either mailscanner or rspamd on top of postfix. You can try one of those As John suggested and its my personal experience also that, If you have

Re: Assistance to protect from spam flood

2019-01-12 Thread John Fawcett
On 12/01/2019 15:52, Nick Howitt wrote: > > > On 12/01/2019 14:47, John Fawcett wrote: >> restrictions only for inbound email on port 25 they may block some badly >> configured servers, but I don't think its a big issue. YMMV. I'd >> configure the backup server as far as possible with the same >>

Re: Assistance to protect from spam flood

2019-01-12 Thread Nick Howitt
On 12/01/2019 14:47, John Fawcett wrote: On 12/01/2019 15:23, Nick Howitt wrote: On 12/01/2019 11:43, John Fawcett wrote: On 12/01/2019 12:09, Nick Howitt wrote: Hi all, Until recently I did not receive too much spam and had it pretty-much under control. This week has gone mental. So far

Re: Assistance to protect from spam flood

2019-01-12 Thread Nick Howitt
On 12/01/2019 14:23, Nick Howitt wrote: On 12/01/2019 11:43, John Fawcett wrote: On 12/01/2019 12:09, Nick Howitt wrote: Hi all, Until recently I did not receive too much spam and had it pretty-much under control. This week has gone mental. So far this week I have received 29860

Re: Assistance to protect from spam flood

2019-01-12 Thread John Fawcett
On 12/01/2019 15:23, Nick Howitt wrote: > > > On 12/01/2019 11:43, John Fawcett wrote: >> On 12/01/2019 12:09, Nick Howitt wrote: >>> Hi all, >>> Until recently I did not receive too much spam and had it pretty-much >>> under control. This week has gone mental. So far this week I have >>> received

Re: Assistance to protect from spam flood

2019-01-12 Thread Nick Howitt
On 12/01/2019 11:43, John Fawcett wrote: On 12/01/2019 12:09, Nick Howitt wrote: Hi all, Until recently I did not receive too much spam and had it pretty-much under control. This week has gone mental. So far this week I have received 29860 connection attempts form {some_random_number}@qq.com

Re: Assistance to protect from spam flood

2019-01-12 Thread Dominic Raferd
On Sat, 12 Jan 2019 at 11:10, Nick Howitt wrote: > Hi all, > Until recently I did not receive too much spam and had it pretty-much > under control. This week has gone mental. So far this week I have > received 29860 connection attempts form {some_random_number}@qq.com to >

Re: Assistance to protect from spam flood

2019-01-12 Thread John Fawcett
On 12/01/2019 12:09, Nick Howitt wrote: > Hi all, > Until recently I did not receive too much spam and had it pretty-much > under control. This week has gone mental. So far this week I have > received 29860 connection attempts form {some_random_number}@qq.com to >

Assistance to protect from spam flood

2019-01-12 Thread Nick Howitt
Hi all, Until recently I did not receive too much spam and had it pretty-much under control. This week has gone mental. So far this week I have received 29860 connection attempts form {some_random_number}@qq.com to {the_same_random_number}@howitts.co.uk. I have a mail server and two backup