Loading ...
Sorry, an error occurred while loading the content.
 

Postfix forwarding may result in backscatter

Expand Messages
  • Stefan Seidel
    Hi, I am using Postfix for some time now and up to now I could always make it behave the way it should. However, I have a problem now: I use virtual_alias_maps
    Message 1 of 8 , Aug 31 8:07 AM
      Hi,

      I am using Postfix for some time now and up to now I could always make it
      behave the way it should. However, I have a problem now:

      I use virtual_alias_maps (with mysql backend, not that it would matter) to
      sort mail into local user's mailboxes, but also sometimes to forward mail
      to external mail addresses (upon user request). I know that this kind of
      forwarding is not always the best, but it works most of the time.

      This forwarding to external addresses however, makes my Postfix create
      backscatter. Example:
      hijacked@... sends email to user@... ->
      virtual_alias_maps says: deliver it to interestedparty@...
      However, the mail server at gmx.example.com may sometimes reject the
      message for any reason, which causes my Postfix to generate a bounce
      message to hijacked@... - which is obviously not something
      anyone would want.

      Any proposed solutions I found always attacked the problem either using
      spam filters (not applicable in this case) or changes in the receiving mail
      server (how would I convince any bigger email provider to do that?).

      The backscatter FAQ about Postfix gives loads of things to do for
      preventing incoming backscatter, but now Postfix is generating the
      backscatter. How do I stop it from doing so?

      Thanks,

      Stefan
    • Wietse Venema
      ... There are two options that I am aware of. 1) Add support to predict the future, so that Postfix can predict that a down-stream MTA would reject a forwarded
      Message 2 of 8 , Aug 31 8:20 AM
        Stefan Seidel:
        > This forwarding to external addresses however, makes my Postfix create
        > backscatter. Example:
        > hijacked@... sends email to user@... ->
        > virtual_alias_maps says: deliver it to interestedparty@...
        > However, the mail server at gmx.example.com may sometimes reject the
        > message for any reason, which causes my Postfix to generate a bounce
        > message to hijacked@... - which is obviously not something
        > anyone would want.

        There are two options that I am aware of.

        1) Add support to predict the future, so that Postfix can predict
        that a down-stream MTA would reject a forwarded message. Please
        keep me updated of any progress that you are making in this area.

        2) Don't forward SPAM.

        Other options involve loss of legitimate mail by dropping non-delivery
        notifications for forwarded mail, which I cannot recommend.

        Wietse
      • Victor Duchovni
        ... You can t, some backscatter is unavoidable. If the volume is too high for a given mailbox, you may need to ask the user to stop forwarding mail via your
        Message 3 of 8 , Aug 31 8:22 AM
          On Tue, Aug 31, 2010 at 05:07:10PM +0200, Stefan Seidel wrote:

          > I use virtual_alias_maps (with mysql backend, not that it would matter) to
          > sort mail into local user's mailboxes, but also sometimes to forward mail
          > to external mail addresses (upon user request). I know that this kind of
          > forwarding is not always the best, but it works most of the time.
          >
          > This forwarding to external addresses however, makes my Postfix create
          > backscatter. Example:
          > hijacked@... sends email to user@... ->
          > virtual_alias_maps says: deliver it to interestedparty@...
          > However, the mail server at gmx.example.com may sometimes reject the
          > message for any reason, which causes my Postfix to generate a bounce
          > message to hijacked@... - which is obviously not something
          > anyone would want.
          >
          > Any proposed solutions I found always attacked the problem either using
          > spam filters (not applicable in this case) or changes in the receiving mail
          > server (how would I convince any bigger email provider to do that?).
          >
          > The backscatter FAQ about Postfix gives loads of things to do for
          > preventing incoming backscatter, but now Postfix is generating the
          > backscatter. How do I stop it from doing so?

          You can't, some backscatter is unavoidable. If the volume is too high
          for a given mailbox, you may need to ask the user to stop forwarding
          mail via your site. Postfix is not psychic and cannot predict which
          mail remote mailbox services will refuse. It would be wrong for Postfix
          to silently discard undeliverable mail without sending a bounce.

          --
          Viktor.
        • Stefan Seidel
          On Tue, 31 Aug 2010 11:20:37 -0400 (EDT), Wietse Venema ... Well, if there s a zero-false-positive and 100% accurate spam filtering solution out there, please
          Message 4 of 8 , Aug 31 8:57 AM
            On Tue, 31 Aug 2010 11:20:37 -0400 (EDT), Wietse Venema
            <wietse@...> wrote:
            > Stefan Seidel:
            >> This forwarding to external addresses however, makes my Postfix create
            >> backscatter. Example:
            >> hijacked@... sends email to user@... ->
            >> virtual_alias_maps says: deliver it to interestedparty@...
            >> However, the mail server at gmx.example.com may sometimes reject the
            >> message for any reason, which causes my Postfix to generate a bounce
            >> message to hijacked@... - which is obviously not
            >> something anyone would want.
            >
            > There are two options that I am aware of.
            > 2) Don't forward SPAM.
            Well, if there's a zero-false-positive and 100% accurate spam filtering
            solution out there, please let me know.

            > Other options involve loss of legitimate mail by dropping non-delivery
            > notifications for forwarded mail, which I cannot recommend.
            Ok, understood. Now how do I do that ;) Really, I don't care about NDNs
            for _forwarded_ mail, esp. since most of the mail traffic on this address
            is from mailing lists. Additionally, the mail is also stored to a local
            mailbox. I know, that means that users could fetch them via
            POP3/IMAP/Webmail, but as it is, they prefer getting it forwarded.

            Stefan
          • Simon Waters
            ... Most mailing lists can automatically detect dead accounts using NDN - but your choice to do it manually or chew on the unwanted bytes for eternity. ...
            Message 5 of 8 , Aug 31 9:39 AM
              On Tuesday 31 August 2010 16:57:16 Stefan Seidel wrote:
              >
              > Really, I don't care about NDNs
              > for _forwarded_ mail, esp. since most of the mail traffic on this address
              > is from mailing lists.

              Most mailing lists can automatically detect dead accounts using NDN - but your
              choice to do it manually or chew on the unwanted bytes for eternity.

              > Additionally, the mail is also stored to a local
              > mailbox. I know, that means that users could fetch them via
              > POP3/IMAP/Webmail, but as it is, they prefer getting it forwarded.

              Just send the email on as if it is new mail rather than using Postfix for
              forwarding, and then it will appear to come from the final destination host,
              and NDN will come back to that host rather than being "general backscatter".

              I dare say the relevant ".forward" file is trivial to create, but one can
              probably use the Sender Rewriting scheme code out there if ".forward" is too
              simple for one's liking.

              But strikes me if you deliver and forward, perhaps that second step doesn't
              even need SMTP? What are you doing that encourages you to duplicate every
              email? Sounds like there maybe a bad design decision lurking.
            • Stefan Seidel
              ... for ... Thanks for the hints. The virtual_alias_map solution is just the one that came with the server management software I use, so I never doubted it. It
              Message 6 of 8 , Aug 31 10:25 AM
                On Tue, 31 Aug 2010 17:39:50 +0100, Simon Waters <simonw@...> wrote:
                > On Tuesday 31 August 2010 16:57:16 Stefan Seidel wrote:
                >>
                >> Additionally, the mail is also stored to a local
                >> mailbox. I know, that means that users could fetch them via
                >> POP3/IMAP/Webmail, but as it is, they prefer getting it forwarded.
                >
                > Just send the email on as if it is new mail rather than using Postfix
                for
                > forwarding, and then it will appear to come from the final destination
                > host,
                > and NDN will come back to that host rather than being "general
                > backscatter".
                Thanks for the hints. The virtual_alias_map solution is just the one that
                came with the server management software I use, so I never doubted it. It
                escapes me however, where I should put a .forward file - the mailboxes are
                virtual users from a MySQL database and as such there's no home directory.
                Putting the file in the maildir doesn't work.

                > I dare say the relevant ".forward" file is trivial to create, but one
                can
                > probably use the Sender Rewriting scheme code out there if ".forward" is
                > too simple for one's liking.
                I was actually in favour of using SRS as I also use SPF and it is often
                mentioned that SRS is needed for SPF to work across forwarding, however
                everything I found on the internet told me that Postfix didn't support it.

                > But strikes me if you deliver and forward, perhaps that second step
                > doesn't
                > even need SMTP? What are you doing that encourages you to duplicate
                every
                > email? Sounds like there maybe a bad design decision lurking.
                Well, it's an email address, hosted on my server, of which several people
                want to receive all mails in their private email account as well. As I said
                before, POP3-ing those messages solves every aspect of this problem, but I
                can't sell that to those users. Also, some mail providers (e.g. the big Y)
                do support neither SSL nor CHAP for fetching external POP3 accounts,
                something I consider broken.

                Thanks so far,

                Stefan
              • Wietse Venema
                ... Postfix implements DKIM, DomainKeys, SPF, SRS etc. via (Milter) plugins. Wietse
                Message 7 of 8 , Aug 31 10:45 AM
                  Stefan Seidel:
                  > I was actually in favour of using SRS as I also use SPF and it is often
                  > mentioned that SRS is needed for SPF to work across forwarding, however
                  > everything I found on the internet told me that Postfix didn't support it.

                  Postfix implements DKIM, DomainKeys, SPF, SRS etc. via (Milter) plugins.

                  Wietse
                • Stefan Seidel
                  On Tue, 31 Aug 2010 13:45:25 -0400 (EDT), Wietse Venema ... Yes, you said that Postfix 2.6.0 and later supports sender address rewriting. However, Debian Lenny
                  Message 8 of 8 , Aug 31 11:00 AM
                    On Tue, 31 Aug 2010 13:45:25 -0400 (EDT), Wietse Venema
                    <wietse@...> wrote:
                    > Stefan Seidel:
                    >> I was actually in favour of using SRS as I also use SPF and it is often
                    >> mentioned that SRS is needed for SPF to work across forwarding, however
                    >> everything I found on the internet told me that Postfix didn't support
                    >> it.
                    >
                    > Postfix implements DKIM, DomainKeys, SPF, SRS etc. via (Milter) plugins.
                    >
                    > Wietse
                    Yes, you said that Postfix 2.6.0 and later supports sender address
                    rewriting. However, Debian Lenny only has 2.5.5. My problem, I know. And,
                    I
                    still didn't find a SRS milter _implementation_. Probably need to write
                    one
                    myself...

                    Stefan
                  Your message has been successfully submitted and would be delivered to recipients shortly.