antispam techniques in postfix on linux

Question

We have an issue of incoming spam on the server hosting several domains. Its running postfix on CentOS 5.x. Please suggest the techniques that can be enabled on the server to prevent incoming spam.

Answer 1

Have a look at policyd-weight (http://policyd-weight.org/).

Like postfix, it has good defaults and does its job within the smtp dialog before postfix has to accept the mail and waste cpu/hdd ressources for it and it is implemented in less than 5 minutes.

The difference to most other implementations of blacklisting rules is, that it creates a score based on several DNSBL, but it also checks if the reverse DNS is set correctly, the foreign MTA behaves like a real MTA (or like a spambot).

Answer 2

Greylisting (I use milter-greylist) + spamassassin + spamhaus work pretty decently. All of them are milter based, and should be MTA-agnostic.

I have also a variety of sendmail tricks, like delaying HELO, penalties for more than two wrong addresses, maximum rates etc. Postfix may have equivalent techniques.

It's not magic, however. You'll still have spam, but less.

Answer 3

From my main.cf:

smtpd_sender_restrictions =
        hash:/etc/postfix/access

smtpd_recipient_restrictions =
                check_client_access hash:/var/lib/pop-before-smtp/hosts,
                reject_invalid_hostname,
                reject_non_fqdn_hostname,
                reject_non_fqdn_sender,
                reject_non_fqdn_recipient,
                reject_unknown_sender_domain,
                reject_unauth_pipelining,
                permit_mynetworks,
                check_helo_access hash:/etc/postfix/helo_restrictions,
                reject_unauth_destination,
                reject_rbl_client zen.spamhaus.org,
                reject_rbl_client list.dsbl.org,
                reject_rbl_client korea.services.net,
                permit