1

Every time my postfix servers sent emails at the destination the emails headers include the following:

by suppaserver.example.dev (Postfix) with ESMTPSA id 79D412E1A3A

How can I remove the (Postfix) information. My ideia is to send the emails without telling the SMTP server software used to send email.

I tried to set a header check to REPLACE this but it doesn't seem to work, maybe I'm missing something. My header_checks file:

/^.*\(Postfix\).*/ REPLACE

Then I've change my main.cf to include:

header_checks = regexp:/etc/postfix/header_checks
mime_header_checks = regexp:/etc/postfix/header_checks

Then I made a db file with: postmap /etc/postfix/header_checks and restarted postfix systemctl restart postfix.

I also tested my header checks using:

# postmap -q "by suppaserver.example.dev (Postfix) with ESMTPSA id BFA7C2406FF" regexp:/etc/postfix/header_checks 
REPLACE

Since it outputted REPLACE I guess the replace / regex rule is working fine. So why doesn't it work? Is this header included by my own server or somehow by Gmail or the receiving server?


Note: I'm using mail submission, and following some information on the web, I also tried to add this checks the master.cf as:

submission inet n       -       -       -       -       smtpd
  -o cleanup_service_name=subcleanup

cleanup   unix  n       -       -       -       0       cleanup
subcleanup unix n       -       -       -       0       cleanup
  -o header_checks=regexp:/etc/postfix/header_checks

However still no luck.

Thank you.

1

Postfix provides a way to do this without resolving to manual filtering:

sudo postconf mail_name=SomeRandomMTA

From the postfix docs:

mail_name (default: Postfix)

The mail system name that is displayed in Received: headers, in the SMTP greeting banner, and in bounced mail.

0

Hiding this is at best a trivial obstacle for a would-be cracker, and can be a stumbling block for some downstream recipient trying to troubleshoot mail problems. Don't do this.

  • 1
    This isn't an answer and should probably be posted as a comment instead. Regardless, I mostly agree. Fingerprinting SMTP servers is not very difficult, so this won't stop a determined attacker. However, hiding as much non-vital information as possible is generally regarded as good security practice, so the question is interesting from more than an academic point of view. – tarleb Jan 27 '16 at 6:55
  • @tarleb, that it is "generally regarded as good practice" doesn't make it right. Typical attackers either aim at anything that moves, or scout ahead. None of those will be hampered in the least by childish "let's play hide and seek" games. – vonbrand Jan 27 '16 at 10:21
  • 1
    @tarleb "hiding as much non-vital information as possible is generally regarded as good security practice" thats it. Also... seems like some services change their spam rating when detecting email coming from postfix servers. – TCB13 Feb 1 '16 at 15:42
  • @TCB13 Interesting, I didn't know that. Thanks :) – tarleb Feb 2 '16 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.