I'm running Postfix on my personal server in a data centre. I am not a professional mail hoster and not a Postfix expert, it is just used for a few domains served from that server.
IIRC, I mostly followed this howto when setting up Postfix. Mails addressed
to one of the domains the server manages are delivered locally (/srv/mail)
to be fetched with Dovecot. Mails
to other domains require usage of SMTPS. The mailbox configuration is stored in MySQL.
The problem I have is that I suddenly found new mailboxes being created on the disk. Let's say I have the domain 'example.com'. Then I would have lots of new directories, e.g.
/srv/mail/example.com/abenaackart
/srv/mail/example.com/abenaacton
etc.
There are no entries for these addresses in my database, neither as a mailbox nor as an alias.
It's clearly spam from auto-generated names. Most of them start with 'a', a few with 'b' and a couple of random ones with other letters. At first I was afraid of an attack, but all security restrictions seem
to work. If I try
to send mail
to these addresses, I get an "Recipient address rejected: User unknown in virtual mailbox table" during the 'RCPT
TO' stage.
So I looked into the mails stored in these mailboxes. Turns out that all of them are bounces. It seems like all of them were sent from a randomly generated name
to an alias that really exists on my system, but pointed
to an invalid destination address on another host. So Postfix accepted it, then tried
to redirect it
to another mail server, which rejected it. This bounced back
to my Postfix server, which now took the bounce and stored it locally -- because it seemed
to be originating from one of the addresses it manages.
Example:
My Postfix server handles the example.com domain.
[email protected] is configured
to redirect
to [email protected].
[email protected] has since been deleted from the Hotmail servers.
Spammer sends mail with FROM:
[email protected] and TO:
[email protected].
My Postfix server accepts the mail and tries
to hand it off
to hotmail.com.
hotmail.com sends a bounce back.
My Postfix server accepts the bounce and delivers it
to /srv/mail/example.com/bob.
The last step is what I don't want. I'm not quite sure what it should do instead, but creating hundreds of new mailboxes on my disk is not what I want...
Any ideas
how to get rid of this behaviour? I'll happily post parts of my configuration, but I'm not really sure where
to start debugging the problem at this point.
