[SOLVED] How to have a catchall and reject spam sent to specific addresses?

[frankman]

Hello.

I have a catchall account, so I get quite a bit of spam. Spamassassin correctly junks most of them. But I'm seeing that many of the spam keep using the same non-existing recipient (i.e. webpage@example.com, etc.).

When signing up with some services, I created throwaway accounts, so I need to keep a catchall.

How do I have a catchall account and *reject* those emails sent to non-existing accounts? I want those to be rejected to avoid backscatter and not even need to reach Spamassassin to process.

ZCS 5.0.7-64bit + CentOS 5.2

[phoenix]

Improving Anti-spam system - Zimbra :: Wiki

[frankman]

Thanks for the link, but doesn't look quite like what I'm looking for. Sorry, I was not clear.

I signed up on some sites and entered a "fake" or "throwaway" email address, (ie. twitter.com@mydomain.com, etc.), but these addresses do not exist in Zimbra and will not be created. The catchall catches and deliver the email to me. From there, I can tell from the "To:" field where the mail came from.

But with the catchall, spam of course is getting in. But I noticed a lot of the spam is using the same email addresses (addresses I never created, like pren@mydomain.com, lxh@mydomain.com, info@mydomain.com, sales@mydomain.com, etc.).

Is there a way to *list* specific email addresses to reject (at the smtp level so spamassassin isn't involved) and still be able to keep the catchall account? I know this won't solve the spam problem, but it should reduce a significant amount of spam.

[phoenix]

Originally Posted by frankman

I signed up on some sites and entered a "fake" or "throwaway" email address, (ie. twitter.com@mydomain.com, etc.), but these addresses do not exist in Zimbra and will not be created. The catchall catches and deliver the email to me. From there, I can tell from the "To:" field where the mail came from.

A catchall address is a spammers dream, you'll always get spam in there.

Originally Posted by frankman

Is there a way to *list* specific email addresses to reject (at the smtp level so spamassassin isn't involved) and still be able to keep the catchall account? I know this won't solve the spam problem, but it should reduce a significant amount of spam.

You would be far better having the throwaway address as an alias of your normal account and you can still check the from and to headers. You can then modify the zmmta.cd option

smtpd_reject_unlisted_recipient

and change it from no to yes then restart postfix. That change will need to be made after each upgrade.

[frankman]

Thanks for the quick reply!

Originally Posted by phoenix

You would be far better having the throwaway address as an alias of your normal account and you can still check the from and to headers.

The problem is that I don't recall all the throaway addresses I created :-(.
That's a good idea and seems to be the way to go going forward.

[phoenix]

Originally Posted by frankman

The problem is that I don't recall all the throaway addresses I created :-(.

It's difficult to know what to sugegst in this case. Perhaps you could add the address that you do remember as an alias and keep the catchall for a couple of weeks and see what turns up. Do you remember the sites you've subscribed to with these throwaway addresses? If you do then I'd kill the catchall account after a while and then just subscribe again with new throwaway addresses that would now be created as an alias on your normal account. It's about the best I can think of at the moment, perhaps someone will give you a more inventive suggestion.

[frankman]

I scanned and found about 40 throwaway addresses, but I'm sure there's more out there.

By the way...
Is there anyway to bulk add/import aliases?
And is there anyway to export a list them to a file? I want to be able to sort them alphabetically to view them.

[phoenix]

You can use zmprov to list the aliases for an account:

zmprov ga account@yourdomain.com | grep zimbraMailAlias

you'd have to script the add but you can do it with zmprov:

addAccountAlias(aaa) {name@domain|id} {alias@domain}

[frankman]

Great, both worked!

For anyone else reading this, a sample of the command is here)

Thanks, Bill!

[phoenix]

Glad you've got it working.