<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoPlainText">Hi Michael,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> We are having issues with spammers sending thousands of emails to non-existent users on our hosted domains and our BX server then bouncing them as "554 5.5.1 Error: no valid recipients" and our IP consequently getting blacklisted for
backscatter.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Microsoft hate us now – Hotmail etc. and block all email from our subnet! :-/<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> 5210R<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Is there any practical way to stop “no valid recipient” email being sent out from the server?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">Let us take a look at the source of the problem:<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">A SPAM-sender connects from a dial-up IP or botnet or a hacked server to
<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">your MTA and claims to be someone he isn't. Like whatever@hotmail.com <mailto:whatever@hotmail.com>.
<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">And he then tries to send email to a non-existing user on your end.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">This can cause backscatter, as the non-delivery-notice is delivered to
<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">the claimed (but faked) whatever@hotmail.com <mailto:whatever@hotmail.com> sender address.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="color:black">Exactly ...<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">For legitimate emails you want non-delivery-notice to inform a
<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">legitimate sender that he's not getting through.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">How to defeat backscatter in case of faked sender addresses?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">Here are three recommendations:<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">1.) Switch to Postfix in the GUI<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">This has stricter sender verification checks.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="color:black">Will do.<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">2.) Enable and configure SPF and switch it to "Sign & Verify" mode<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">This checks the SPF records of sender domains and if the senders<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">IP is not within the SPF records published by say hotmail.com, then<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">the email will be rejected at the MTA w/o bounce and NDN.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Sounds right. Hadn’t thought of this.<o:p></o:p></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText" style="margin-left:36.0pt">To really prevent any bounces ever to leave your server and go somewhere
<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">you don't want them to go to? This can be done via Postfix.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">Edit /usr/sausalito/bin/custom-postfix-confgen.sh and at the bottom add
<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">these lines:<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">postconf -e 'bounce_notice_recipient = <your_email_address>'<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">postconf -e '2bounce_notice_recipient = <your_email_address>'<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">Be sure to change <your_email_address> to a valid email address which
<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">you want all bounces to go to.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">Then restart Postfix and you should be good to go:<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:36.0pt">systemctl restart postfix<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">This sounds spot on. Good advice as usual!<o:p></o:p></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Many thanks<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Colin</span><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>