I have a Postfix server running with also Postgrey enabled. It seems to work great however in the last week I have noticed a huge increase in spam mail that is sent to postmas...@... I am configured on the mail server to get all mail destined for Postmaster and it appears that everyone and their mother is spamming my postmaster account. I don't know if the message filters and greylisting I have configured on the server are being applied to mail sent to postmaster because very obvious spam that my smtpd_*_restrictions under main.cf should be filtering and then if not, Postgrey should for sure be filtering them out!
I am just trying to understand why this spam is getting through. I am posting my postconf -n below as well as some examples from my logs of messages sent to postmaster. Pretty much the only messages that are sent to that particular address are spam. alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin config_directory = /etc/postfix content_filter = amavisfeed:[127.0.0.1]:10024 daemon_directory = /usr/libexec/postfix home_mailbox = Maildir/ html_directory = no inet_interfaces = all mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, $mydomain, mail.$mydomain mydomain = iamghost.com myhostname = mail.iamghost.com mynetworks = $config_directory/mynetworks myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES recipient_delimiter = + relay_domains = sample_directory = /usr/share/doc/postfix-2.3.3/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtpd_banner = $myhostname ESMTP smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, reject_unlisted_recipient, check_policy_service unix:postgrey/socket, check_sender_access hash:/etc/postfix/sender_access, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unknown_reverse_client_hostname, permit smtpd_tls_CAfile = /etc/ssl/intermediate.crt smtpd_tls_auth_only = yes smtpd_tls_cert_file = /etc/ssl/mail.crt smtpd_tls_key_file = /etc/ssl/mail.key smtpd_tls_loglevel = 1 smtpd_tls_security_level = may smtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cache smtpd_tls_session_cache_timeout = 3600s tls_random_source = dev:/dev/urandom unknown_local_recipient_reject_code = 550 **From my maillogs** [r...@mail ~]# cat /var/log/maillog | grep -i "Sep 23" | grep -i "92.243.237.70" Sep 23 16:01:13 mail postfix/smtpd[31246]: connect from unknown[92.243.237.70] Sep 23 16:01:14 mail postfix/smtpd[31246]: 09E43779B26: client=unknown[92.243.237.70] Sep 23 16:01:15 mail postfix/smtpd[31246]: disconnect from unknown[92.243.237.70] Sep 23 16:01:21 mail amavis[29716]: (29716-05) Passed SPAMMY, [92.243.237.70] [92.243.237.70] <bethbeachheadcoff...@yesonpropk.org> -> <postmas...@iamghost.com>, Message-ID: <006201ca3c99$5f10f490$1d32dd...@org>, mail_id: Yo1zL4wIGwB4, Hits: 6.995, size: 6091, queued_as: 944B7779B31, 5988 ms Trying to understand if these messages are routed simply because they're sent to postmaster or if it did pass all smtpd_*_restrictions and also pass greylisting parameters (which I find extremely unlikely). Can someone please help me understand why my postmaster account is getting slammed with spam?
