Postfix Configuration: Blocking Spam with Header Checks

As a mail server administrator, you might encounter situations where spam emails pass through even when they have valid SPF records. One effective way to combat this is by configuring Postfix to use header checks with regular expressions to block unwanted emails. In this blog post, we’ll walk through how to set up header checks in Postfix to block spam emails.

Understanding Postfix Header Checks

Postfix header checks allow you to filter emails based on specific patterns in the email headers. By using regular expressions, you can create rules to reject emails from known spam sources or with specific characteristics.

Setting Up Header Checks in Postfix

Step 1: Create a Header Checks File

First, you need to create a file that will contain your header check rules. You can place this file in the /etc/postfix directory. For example, let’s create a file named header_checks.

sudo nano /etc/postfix/header_checks

Step 2: Define Your Header Check Rules

In the header_checks file, you can define your rules using regular expressions. For instance, if you want to block emails from the domains caeonline.com and smtp2go.com, you can add the following rule:

/^Received: .*caeonline\.com/ REJECT
/^Received: .*smtp2go\.com/ REJECT
/^From: .*smtp2go\.com/ REJECT
/^From: .*caeonline\.com/ REJECT
# You can also filter the subject line by following the sample below.
/^Subject: .*caeonline\.com(.+)$/ REJECT
/^Subject: .*cmtp2go\.com(.+)$/ REJECT

This rule looks for the Received header containing the specified domains and rejects the email if a match is found.

Step 3: Update Postfix Configuration

Next, you need to tell Postfix to use the header checks file. Open the Postfix main configuration file /etc/postfix/main.cf and add or update the following line:

header_checks = regexp:/etc/postfix/header_checks

This line specifies that Postfix should use the header_checks file with regular expressions.

Step 4: Apply the Configuration

After updating the configuration file, you need to apply the changes by reloading or restarting Postfix. You can do this using the following command:

sudo systemctl reload postfix

Or, if you prefer, you can restart Postfix:

sudo systemctl restart postfix

Step 5: Test Your Configuration

To ensure that your configuration works as expected, you can send test emails from the blocked domains and verify that they are rejected. Check the mail logs to confirm that the emails are being blocked:

sudo tail -f /var/log/mail.log

You should see entries indicating that emails from the specified domains are being rejected.

Troubleshooting

If you encounter any issues, double-check the following:

1. Syntax Errors: Ensure that there are no syntax errors in the header_checks file. Regular expressions must be correctly formatted.
2. File Permissions: Verify that the header_checks file has the correct permissions and is readable by Postfix.
3. Postfix Logs: Check the Postfix logs (/var/log/mail.log) for any error messages that can help diagnose the problem.

Conclusion

Configuring header checks in Postfix is a powerful way to filter out unwanted emails based on specific patterns in the email headers. By using regular expressions, you can effectively block spam from known sources. In this blog post, we demonstrated how to set up header checks to block emails from the domains caeonline.com and smtp2go.com. With this knowledge, you can customize your own header checks to suit your specific needs and improve the overall security and reliability of your mail server.

For more advanced configurations and additional Postfix features, consult the Postfix documentation.

Happy email filtering!