Hundreds of Backscatter messages

[ron]

Hi,

Over the past few days, one of my users is bombarded with hundreds of backscatter messages.

Our domain has a valid, hardfail SPF configuration.
Also, the /etc/mail/spamassassin/custom.cf file is configured to mark illegitimate NDRs as SPAM:

whitelist_bounce_relays mail.my-domain.com
score ANY_BOUNCE_MESSAGE 5

And still - only about 50% of the backscatter is quarantined - the rest ends up in the user's mailbox.

The attached example shows a message that should have been quarantined, but was still delivered.

Am I missing something? can you advise?...

 

[tom]

did you configure "Configuration/Spam Detector/Backscatter"?

 

[ron]

Hi Tom,

This setting was in place - but after I saw backscatter was still ending up in user's mailbox, I reset this setting and configured the /etc/mail/spamassassin/custom.cf file instead.