How to remove postmaster@example.com messages to undeliverable addresses

[poetry]

Hello,

So I want to make sure that people who are trying to send messages and are blocked (because virus detected) get notified that their message was blocked. If the message that contains virus is quarantined or blocked the sender is not notified of delivery failure. I guess that is just how pmg works and there is nothing I can do about it so I want to use Action Objects - Notification - Receiver - __SENDER__. That works fine but what happens is that bad guys will a lot of times send bad messages with virus from non existing addresses and then I get a lot of messages in queue waiting to be delivered to no-where...
I am using my simple script to monitor the queue and that is extremely useful and I want to keep using it but if I set virus sender notification the queue will get very big once the bad guys start sending virus messages from undeliverable addresses.
Anyone has advice how to deal with this? Is there some setting on postfix that would solve this? I am already using Configuration - Mail Proxy - Options - Before Queue Filtering - Yes that helps with all other blocked messages so sender get response "554 5.7.1 Rejected for policy reasons".
I want to make sure I don't delete any legitimate messages for example if one of our mail servers is down for an hour this "undeliverable" messages should not be removed. I don't know if there is any good solution for this problem. Any advice?

My guess is that if we enable Reject unknown senders. setting that should help. Will test and let you know how it goes.
Configuration - Mail Proxy - Options - Reject Unknown Senders

 

[Stoiko Ivanov]

So I want to make sure that people who are trying to send messages and are blocked (because virus detected) get notified that their message was blocked. If the message that contains virus is quarantined or blocked the sender is not notified of delivery failure.

How PMG reacts depends on a few settings:
* if before queue filtering is enabled - and the message is blocked for all recipients PMG will respond with a 5xx to the sending server (then the sending server needs to notify the sender...)
* If only part of the recipients block the mail PMG responds with 250 OK - but depending on the setting 'send NDR on Blocked Mail' the sender will get a bounce from PMG for those recipients where it got blocked
* if the delivery fails after the rulesystem postfix will create and send a bounce message to the sender
* if before-queue filtering is disabled then the sending of bounces depends on send NDR on Blocked Mail..

I would not send notifications to external senders in general

I hope this helps!

 

[poetry]

I would not send notifications to external senders in general

I generally agree with this but the reality is different. I do want legitimate false positive senders to be notified when they are sending email and it's blocked by false positive virus detection. I looked in quarantine and real people sending email send multiple emails asking why the receiver is not responding because they had 0 notification back that their email was quarantine or blocked. That is the reason why I had to add notifications to quarantined virus senders.

I am currently using all this options it does help to reduce notifications to invalid senders but does not completely solve the problem:
Configuration - Mail Proxy - Options - Reject Unknown Clients
Configuration - Mail Proxy - Options - Reject Unknown Senders
Configuration - Mail Proxy - Options - SMTP HELO checks
Configuration - Mail Proxy - Options - Use SPF
Configuration - Mail Proxy - Options - Before Queue Filtering

Here is the similar problem and I don't think the solution is a viable option without manual intervention
https://forum.proxmox.com/threads/e...-specific-email-addresses.118160/#post-511659

I am currently implementing quarantine access for all users so that will mean I will also have to change how the blocking and notifications work. I still have a lot of work ahead before I see where are the issues will report back when I have more information in another thread https://forum.proxmox.com/threads/h...-and-attachment-all-in-one-quarantine.118519/

 

[Stoiko Ivanov]

I would rather suggest to send notification to your downstream users - instead of the internet - if a mail gets put into quarantine and it's inbound - notify the recipient, if its outbound notify the sender ... - that way you don't send out notifications to spammers ...

and if a mail is indeed wanted by the recipient, they will contact you

I hope this helps!