Python – Postfix catch-all email, save to combined file


We're running a spam trap / honeypot, and by using the amazing guidance of the members here, I've been able to configure our Ubuntu server running Postfix 2.11.0 to catch all inbound email, regardless of destination address, and send the email to a python script which in turn writes the email to a file. The python script looks like:

#!/usr/bin/env python
import sys
import email
import os
import datetime

em = email.message_from_file(sys.stdin) # Read message from Std Input

strFilename ='%Y%m%d%H%M%S') + ".eml"

output = open('/var/mail/' + strFilename, 'w')

My question is: when we receive an email with two or more recipients, the python script is writing two (or more) .eml files instead of 1 file with both recipients listed. I've compared the .eml files, and they're identical with the exception of 1 line in the header of each file. For example, if I personally send an email to our honeypot collector with a TO address of, and a CC to, the only difference in each file is one line that looks like:


and the other


Is there anyway to write only one file with both X-Original-To: fields listed?

Additional info: SMTP-sink does what we need, and is the path that we're currently running with, but we're hoping to use postfix instead. In postfix, I've added:

virtual_alias_maps = pcre:/etc/postfix/virtual

And then I've created a file at /etc/postfix/virtual that contains

/.*/                        mailin

In /etc/aliases, I've added:

mailin:  "|/var/mail/"

And then my contains the python script above. I also created a new user called "mailin".

Best Answer

I'm afraid that the answer of your question

Is there anyway to write only one file with both X-Original-To: fields listed?



Postfix use X-Original-To header to perform recipient duplication. Of course, you can make postfix write only one file by configure this parameter via

enable_original_recipient = no

The side effect is you will lose original recipient record in both message and maillog.