OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Backscatter being generated from mail aliased to other servers.

From: Victor Duchovni (Victor.Duchovnimorganstanley.com)
Date: Mon Nov 16 2009 - 14:10:48 CST


On Mon, Nov 16, 2009 at 12:53:14PM -0700, Jim Lang wrote:

> OK here is the scenario.
> Spammer sends mail to: usermyclientsdomain.com from forged address
> victimrandomdomain.com
>
> If usermyclientsdomain.com is delivered locally, not a problem, if the
> address is invalid, postix rejects the mail during the smtp connection.
>
> But if usermyclientsdomain.com is an alias to myclientotherserver.com,
> postfix accepts the mail as deliverable and forwards it to hotmail.com.
> But if myclientotherserver.com can for whatever reason not be delivered,
> otherserver.com does what it is supposed to do and rejects the mail during
> the smtp connection, which causes postfix to send out a non-delivery
> report to victimrandomdomain.com -- backscatter.
>
> Is there a way to stop this?

Some backscatter is unavoidable, you can keep the volume low by removing
local aliases to no-longer-valid external addresses, and by rejecting
mail from spam sources, using good blacklists, ...

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomopostfix.org?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.