Deferred messages from Mailer-Daemon

[jpcaldwell]

I get a ton of messages in my deferred queue with a sender address of Mailer-Daemon. I looked up some of the receiver addresses in the logs because they looked fishy and all of the addresses are from spam sent to accounts that don't exist on our server. As far as I can tell Zimbra is trying to bounce these messages back and they're getting stuck in the deferred queue when the sending address doesn't resolve. Are my assumptions correct, and if so how can I set Zimbra to just dump mails to nonexistant addresses instead of trying to bounce them?

[phoenix]

In zmmta.cf change the setting for "smtpd_reject_unlisted_recipient'" to yes save the config and restart postfix. You'll need to change this setting on each upgrade as it isn't preserved.

[jpcaldwell]

Ok, tried that but it doesn't seem to be doing anything.
We used to relay our outbound mail through our ISP (the IP block they gave us was on a few RBLs), after much wailing and gnashing of teeth we finally got a new (clean) ip block so we recently switched to sending directly from Zimbra, is there maybe a setting that needs to be changed back to keep Zimbra from accepting mail to non-existent accounts?

[phoenix]

Originally Posted by jpcaldwell

......, is there maybe a setting that needs to be changed back to keep Zimbra from accepting mail to non-existent accounts?

I've already given you the setting for that, you should see messages in the logs for those non-existent addresses being rejected. That setting does work and I use it on my own server. Do you, by any chance, have any catch-all address set on your Zimbra server?

[jpcaldwell]

I set smtpd_reject_unlisted_recipient to yes, restarted Zimbra, and confirmed it was set with postconf, but haven't seen a change. I don't believe there is a catchall (I'm sure I didn't set it), where would I look to check that?

[phoenix]

If you didn't set a catch-all address then it's not set by default. Do the logs show any messages for the rejected addresses?

[jpcaldwell]

Here's a log snippet for one of the non-existent addresses:

Aug 13 08:25:15 zimbra postfix/qmgr[12483]: 7F5581E4018: from=<helen.davey@blr.airtiger.com>, size=20833, nrcpt=1 (queue active)
Aug 13 08:25:15 zimbra amavis[21779]: (21779-06) ESMTP::10024 /opt/zimbra/amavisd/tmp/amavis-20070813T075921-21779: <helen.davey@blr.airtiger.com> -> <berger@barroncollection.com> SIZE=20833 Received: from zimbra.corvinasnest.com ([127.0.0.1]) by localhost (zimbra.corvinasnest.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <berger@barroncollection.com>; Mon, 13 Aug 2007 08:25:15 -0700 (PDT)
Aug 13 08:25:15 zimbra amavis[21779]: (21779-06) Checking: kXpBL89UREuc [216.188.207.9] <helen.davey@blr.airtiger.com> -> <berger@barroncollection.com>
Aug 13 08:25:17 zimbra postfix/qmgr[12483]: B176E1E401A: from=<helen.davey@blr.airtiger.com>, size=21566, nrcpt=1 (queue active)
Aug 13 08:25:17 zimbra amavis[21779]: (21779-06) FWD via SMTP: <helen.davey@blr.airtiger.com> -> <berger@barroncollection.com>, BODY=8BITMIME 250 2.6.0 Ok, id=21779-06, from MTA([127.0.0.1]:10025): 250 Ok: queued as B176E1E401A
Aug 13 08:25:17 zimbra amavis[21779]: (21779-06) Passed SPAMMY, [216.188.207.9] [216.188.207.9] <helen.davey@blr.airtiger.com> -> <berger@barroncollection.com>, Message-ID: <645691264.98554071382748@blr.airtiger.com>, mail_id: kXpBL89UREuc, Hits: 8.691, queued_as: B176E1E401A, 2571 ms
Aug 13 08:25:17 zimbra postfix/smtp[3420]: 7F5581E4018: to=<berger@barroncollection.com>, relay=127.0.0.1[127.0.0.1], delay=4, status=sent (250 2.6.0 Ok, id=21779-06, from MTA([127.0.0.1]:10025): 250 Ok: queued as B176E1E401A)
Aug 13 08:25:17 zimbra postfix/lmtp[3428]: B176E1E401A: to=<berger@barroncollection.com>, relay=zimbra.corvinasnest.com[75.160.98.106], delay=0, status=bounced (host zimbra.corvinasnest.com[75.160.98.106] said: 550 5.1.1 No such user here (in reply to RCPT TO command))
Aug 13 08:25:47 zimbra postfix/smtp[3432]: CFE451E4018: to=<helen.davey@blr.airtiger.com>, relay=none, delay=30, status=deferred (connect to blr.airtiger.com[208.3.186.20]: Connection timed out)

So as far as I can tell the message to berger@barroncollection.com (which isn't a real account) gets passed through as spammy, and once it's in the system a bounce is sent to the bogus sender address which just gets stuck in my deferred queue.

[phoenix]

Let's make sure that the reject option is set, run the following:

postconf | grep smtpd_reject_unlisted_recipient

looking back at my earlier post I see that I gave you the incorrect file name (I assume you realised that) it should have been zmmta.cf

When it's working you should be seeing messages like this in your logs:

Aug 13 17:22:49 chinook postfix/smtpd[27979]: NOQUEUE: reject: RCPT from unknown[189.187.26.162]: 550 <e9qw701s71ln.dlg@mydomain.com>: Recipient address rejected: mydomain.com; from=<customer-support-refnum-42lwo@rbsdigital.com> to=<e9qw701s71ln.dlg@mydomain.com> proto=SMTP helo=<ZEUS>

[jpcaldwell]

Yeah, I figured zmmta.cf was what you meant. Postfix seems to have the right setting, so I really don't know why this isn't working for me.

[zimbra@zimbra ~]$ postconf | grep smtpd_reject_unlisted_recipient
smtpd_reject_unlisted_recipient = yes

[phoenix]

I assume you have no error messages in your logs like the one I posted?

OK, I'll try sending an email to you from my own server with (hopefully) an invalid address. See what goes through your logs in a few minutes, I'll pm the invalid address I've used.

BTW, I assume you know that you have two mx records pointing to the same IP for you domain? It's not a good idea, you also have a priority of 0 for both of the records (I'm not sure if that's valid). Details in this report.