ASK:Block/Reject [email protected]

Hi all,

I have problem with receiving email, almost everyday my mail server received email from unknown user and use mydomain.com ([email protected]), is it any way ISPConfig can reject it? and I have spamassassin for spam block but still not working, thank you!

 

I think i found the solution, just add these :
smtpd_recipient_restrictions =
permit_sasl_authenticated,
reject_unverified_recipient, -> before permit_mynetworks
permit_mynetworks,
reject_unauth_destination
and add these
unverified_recipient_reject_code = 550

I did some test, I email to [email protected] and [email protected],
realuser:
-to=<[email protected]>, relay=local, delay=0, status=deliverable (delivers to mailbox)
-Virus and Content Scanning: Starting
-Uninfected: Delivered 1 messages

fakeuser:
-to=<[email protected]>, relay=local, delay=0, status=undeliverable (unknown user: "fakeuser")
-reject: RCPT from localhost.localdomain[127.0.0.1]: 550 <[email protected]>: Recipient address rejected: undeliverable address: unknown user: "fakeuser";

so the unknown username / fake @mydomain.com will reject before go to filtering (anti virus and spam) mail server.
Note: i already try use local_recipient_maps, it was working, but it is not what i want, because i need it to drop / reject before spam and anti virus filtering

 

hi,

thanks for the advice, will try that out...

I would like to know which log do you see something like the one you have above? in my syslog, i only see the to=... but not the virus/uninfected line.

 

It's in the mail log.

 

I ask this similar question in another thread but nobody seems to be able to give a straight answer. I checked the /var/log/mail.log and there is nothing that has more or less similar log info as what abadi had shown. The content of the mail.log is as difficult to understand as the ones in syslog

Would it be because of my log/debug level? where should I set it? and to what level?

I am actually in doubt if the antivirus/spam is working in my setup coz I dont see any indication from both logs that spamassasin or clamav is being called

 

SpamAssassin and ClamAV are called by procmail (after Postfix has processed the mails), therefore these processes aren't logged.