Postfix is sending non delivery notification emails caused by spammers

postfixspam

I'm not very experienced with running a mailserver, I do not have it setup as an open relay (I've tested with various outside scanning scripts) However I had noticed my server still generating a lot of nonsense emails.

I believe i have an example here:

Oct 26 08:53:59 localhost postfix/smtpd[29067]: connect from unknown[116.118.82.128]
Oct 26 08:54:00 localhost postfix/smtpd[29067]: 4CF879C459: client=unknown[116.118.82.128]
Oct 26 08:54:01 localhost postfix/cleanup[29071]: 4CF879C459: message-id=<201010261452.FF89D878b40056@[116.118.82.128]>
Oct 26 08:54:01 localhost postfix/qmgr[1754]: 4CF879C459: from=<niloxen9618@32million.com>, size=4046, nrcpt=1 (queue active)
Oct 26 08:54:01 localhost postfix/pipe[29074]: 4CF879C459: to=<hasan@ALOCALDOMAIN>, relay=maildrop, delay=1.3, delays=1.2/0.01/0/0.02, dsn=5.1.1, status=bounced (user unknown. Command output: Invalid user specified. )
Oct 26 08:54:01 localhost postfix/cleanup[29071]: 1DF0B9C45F: message-id=<20101026075401.1DF0B9C45F@LOCALHOST>
Oct 26 08:54:01 localhost postfix/bounce[29076]: 4CF879C459: sender non-delivery notification: 1DF0B9C45F
Oct 26 08:54:01 localhost postfix/qmgr[1754]: 4CF879C459: removed
Oct 26 08:54:01 localhost postfix/qmgr[1754]: 1DF0B9C45F: from=<>, size=6102, nrcpt=1 (queue active)
Oct 26 08:54:01 localhost postfix/smtpd[29067]: disconnect from unknown[116.118.82.128]
Oct 26 08:54:05 localhost postfix/smtp[29077]: 1DF0B9C45F: to=<niloxen9618@32million.com>, relay=mail.32million.com[64.13.232.144]:25, delay=4.2, delays=0.1/0.01/1.3/2.7, dsn=2.0.0, status=sent (250 OK id=1PAeM7-0001Od-64)
Oct 26 08:54:05 localhost postfix/qmgr[1754]: 1DF0B9C45F: removed

Would I be correct in assuming that the spammer is getting my server to send out a bounce message with his spam to some address?

I would appreciate any advice to point me in the direction of stopping this.

Thanks,

Best Answer

You are right, you're sending DSN messages to innocent people (no offense, as this might sound too dramatic).

I bet you have either virtual users and/or someone acting as a backup MX for you. The key to prevent this behaviour is to check if these accounts exist on your server (if you have a backup MX, it needs to do the same).

Here are some config snippets that should help:

If I understand this correctly, you need to specify local/virtual domain and every user.

I'm not sure if I could explain this, I'm not a native english speaker. Just ask if somethings not clear.

Related Topic