Postfix / Spamassassin: Fixed mail returned to sender

Several different points:

• It should be on serverfault.com, but since I'm not in beta, I'll answer it here.

• The result of postconf -n is better than including what you think are relevant lines in main.cf. Also include the relevant lines from master.cf if you have parameter overrides or other settings in there.

• Do not then accept scanned mail. If you are using SpamAssassin as a post-queue filter in Postfix (the usual way to run it), you need to either flag and deliver (and filter using client-side rules) or quarantine mail without notifying the sender. In terms of your question, you are probably the backscatter source. Stop that. See http://www.postfix.org/BACKSCATTER_README.html for example . Consider amavisd-new to integrate SpamAssassin into Postfix with all the useful features.

• Consider rolling all your restrictions in smtpd_recipient_restrictions. It is generally easier to manage a linear flow of restrictions than it is to interact with smtpd_ {client, helo, sender, recipient} _restrictions.

• To prevent Postfix from being sent from outside, add a sender_access map that rejects the send mail request from your domains:

smtpd_recipient_restrictions = 
  permit_sasl_authenticated, 
  permit_mynetworks, 
  reject_unauth_destination, 
  check_sender_access hash: $ config_directory / reject_mydomains
  reject_unknown_recipient_domain,
  reject_unknown_sender_domain,
  reject_invalid_hostname

And in reject_mydomains

example.com.au REJECT you are not me

This will likely be susceptible to false positives with mail that comes from senders with a legitimate (?) Reason for using your domain as an envelope sender (e-cards, invitations, maybe some outsourced services like polls or whatnot). You can whitelist your "you-not-me" rules with the client_access map in front of your sender_access map that returns OK or the appropriate restriction class (see http://www.postfix.org/RESTRICTION_CLASS_README.html ).

You can use similar HELO checks to prune HELO-ing clients with custom hostname / IP or known bad HELO strings

smtpd_recipient_restrictions = 
  permit_sasl_authenticated, 
  permit_mynetworks, 
  reject_unauth_destination, 
  check_helo_access hash: $ config_directory / helo_checks
  check_sender_access hash: $ config_directory / reject_mydomains
  reject_unknown_recipient_domain,
  reject_unknown_sender_domain,
  reject_invalid_hostname

and in helo_checks:

example.com.au REJECT BAD-HELO you are not example.com.au
mailserver.example.com.au REJECT BAD-HELO you are not me
localhost REJECT BAD-HELO you are not me
localhost.localdomain REJECT BAD-HELO you are not me
# where 1.2.3.4 is the IP of your server
1.2.3.4 REJECT BAD-HELO you are not me
127.0.0.1 REJECT BAD-HELO you are not me

Finally, it is a very good idea to sign up for a reputable service like RBL. The best RBL for most purposes is zen.spamhaus.org . It can be used for light to moderate workloads, and if your usage is large enough to pass their free / paid threshold, the cost is well worth it. To configure in Postfix add

reject_rbl_client zen.spamhaus.org

to your smtpd_recipient_restrictions. Do this after your cheap local checks to save load and latency DNS requests, but before costly local checks like reject_unverified_recipient (you don't use this and probably don't need it from the problem description).