Fighting Spam: Block entire (T)TLD with Postfix

14 Comments

1. 

   Jacques on July 18, 2018 at 2:38 am

   Hi All,

   I use Postfix v2.10.1 and I followed your tutorial.
   My /etc/postfix/access file :
   /\.date$/ REJECT

   When I try this conf file with the next command, it seems that the regular expression doesn’t work :
   postmap -q “toto@test.date” hash:/etc/postfix/access

   But if I modified access file with an entry as follow :
   toto@test.date REJECT

   The test command works.

   Maybe any ideas ?

   Jacques

   Reply
   • 

     Lishack the Fox on January 15, 2019 at 8:26 am

     Hi,
     postmap is for hash (or lmdb files), but this is pcre (Perl Compatible Regular Expression).
     You may also need to install postfix-prce package.

     Regads, Lishack the Fox.

     Reply
   • 

     David on January 16, 2019 at 6:52 am

     Lishack is correct.
     You need to put the code I provided above into a new file, and then point to that file with the following configuration parameter: check_sender_access pcre

     Reply
2. 

   Thorsten Gust on July 20, 2018 at 5:14 am

   Hi David,

   Build my first own Mail-Server and realized how many things must be done to get that running, including
   fighting spam. In the past I’ve supported SUN Microsystems Mail Server and does not know how many stress it is to have an own one.

   So thanks for that blog it helps me so much !

   Thanks and best regards
   Thorsten

   Reply
3. 

   sophie on September 12, 2018 at 12:57 pm

   1. I use a .xyz for my businness. Like many others. The domain was cheap to register a few years ago. Instead of blocking entire domains, why not be a little more intelligent in this?
   2. Postfix is not meant to be a spam filter, per se. It’s an MTA. Take the time to configure SpamAssasin or RSPAMD. Also chain in the clamav-milter. Maybe you’ll have fewer false positives.
   Regards..

   Funnily I knew a sys admin in the Netherlands who blocked the whole *.uk TLD, and then wondered why his email alerts from amazon.co.uk never arrived in his mailbox.

   Reply
   • 

     David on September 14, 2018 at 5:27 am

     Those are certainly good points. And you are correct: Postfix is an MTA. You’ll get no argument from me there.
     However, as you likely know, the volume of spam that the typical MTA receives is absurd. We have made the decision to block these TTLDs because there has never been a use case for us, or any of our clients whose email is hosted on our infrastructure, to communicate with others who have an email address at one of those TTLDs mentioned. Here’s a nice article from Brian Krebs on the subject of TLDs and spam: https://krebsonsecurity.com/tag/new-tld-spam/

     Reply
4. 

   Perry on September 15, 2019 at 6:12 pm

   Nice tutorial, works perfect! Those new TLD’s are a pain in the ass.

   Reply
5. 

   Xaeus on September 19, 2019 at 3:18 am

   I’m currently testing how to allow an exception.
   I mean if I block a domain called .blocked with /\.blocked$/ REJECT I want to previously allow one exception for something like exception.blocked.

   Reply
   • 

     David on September 20, 2019 at 9:05 pm

     You can whitelist senders by hostname or IP address by using setting a smtpd_recipient_restrictions stanza, and adding the following to that stanza:

     check_client_access hash:/etc/postfix/rbl_override

     In your rbl_override file, it might look like something like this:
     1.1.1.1 OK
     mail.example.com OK

     Then do a “postmap /etc/postfix/rbl_override”, reload Postfix, and you’re good to go!

     Reply
6. 

   William Keeley on October 10, 2019 at 1:20 am

   Today I just banned an entire ISP from sending me email. In fact it happens to have over 1000 CIDR’s I had to sift through. What is much different than usual is the fact that I put a referral to the spam supporting ISP’s toll free number for assistance in resolving the issue. I want to put the onus and responsibility for the cost of spam BACK ON the spammers and their supporting ISP’s where it belongs.
   The list I use is in the following format:
   23.228.77.0/24 REJECT You are blocked for network abuse: Spamming – Contact Globalfrag/LayerHost Technical Support 1-833-247-HOST to resolve issue.

   Reply
7. 

   lbutlr on November 18, 2019 at 6:27 am

   I check my logs for mails that are rejected because of their TLD and sometimes make exceptions or even allow a TLD I’d previous;y blocked. I’ve never seen anything that looked even vaguely like it might be legit from .xyz .top or many others.

   (I take a different tact, I block ALL TLDs and then white list the ones I will accept mail from, this way new TLDs do not get an opportunity to spam my server.)

   Reply
8. 

   Stan Williams on May 4, 2020 at 12:29 am

   Those are new tld’s and people are buying them . I wish i had seen this before I bought my stan.stream domain what a load of crap to happen to people like me who HATE spammers. Spammers should be prosecuted.

   Reply
9. 

   jnewman67 on May 23, 2022 at 1:40 am

   You have NO IDEA how long I’ve been searching for this solution! Cannot believe it took years of googling to find this – just had to use the right of guess-words to search for (“wildcards” was the key!).
   I had a SENDER_CHECKS file that was 22,250 lines long trying to keep the spam in check – created 270 entries in my reject_domains file, and the sender_checks is now down to 7770 after removing duplicates.
   Thank you, thank you, THANK YOU!!!!!

   Reply
   • 

     David on May 25, 2022 at 8:34 am

     I’m glad it was helpful! 🙂

     Reply