-1

My MTA is receiving lots of emails with no from address specified, for example:

Sep 15 17:09:57 mta1 sm-mta[46864]: STARTTLS=server, relay=mx01.aquila-capital.de [83.236.242.254], version=TLSv1/SSLv3, verify=FAIL, cipher=AES128-SHA, bits=128/128
Sep 15 17:09:57 mta1 sm-mta[46864]: s8FH9vmD046864: from=<>, size=9265, class=0, nrcpts=1, msgid=<67eb1bbb-b14d-45f2-9e61-63d058cd2d00@AC-GROUP.DE>, proto=ESMTP, daemon=Daemon0, relay=mx01.aquila-capital.de [83.236.242.254]

I want to reject them straight away without any further processing. Is it safe and what rule could be added to sendmail for it?

Greg
  • 198
  • 10
  • 1
    You want to reject bounces? This doesn't seem like a good idea. – Michael Hampton Sep 15 '14 at 17:20
  • 1
    They are not bounces. Those are incoming emails that are being rejected anyway with SMTP error code 550 User unknown as they usually are addressed to a random user name. – Greg Sep 15 '14 at 18:10
  • 2
    Some of them MAY be legitimate bounces. You request to broad reject reason. – AnFi Sep 15 '14 at 21:26
  • Hence I asked if it's safe. Instead of spamming the question with comments like "oh, a bad idea, oh you request to do bla bla bla" make some effort and say why. This is why people use this site and ask questions. To learn something, isn't? – Greg Sep 17 '14 at 12:00

1 Answers1

4

What you are asking to do is a very bad idea. For multiple reasons:

  • First of all, you may very well end up rejecting legitimate bounces. This means users on your domain may never know, if an email they send did not get delivered due to mistyped address or some other error.
  • Secondly other services might be starting an SMTP session to validate correctness of email addresses. Your users may end up getting their email address rejected as invalid on some sites, and it is possible that some domains will no longer accept mail from your domain.

My recommendation is that instead, you do the following:

  • Always accept <> as a sender address.
  • If the RCPT address does not exist, reject it with code 550 regardless of what the sender address was.
  • If possible, at the end of DATA you can scan the contents to look for a Message-ID originating from your domain. If none is found, you can reject the mail at the end of DATA.
  • Don't worry about log messages about attempts to send bounces to non-existing addresses. Nobody was bothered by the email, since it wasn't delivered.
  • If you need to, create a secondary less verbose log file.
kasperd
  • 30,455
  • 17
  • 76
  • 124
  • Why would a bounced message have the 'from' address set to '<>'? Even if the sender mistyped the recipient's address, they would be bounced by a legitimate server and should have the 'from' set to 'postmaster' or other legitimate email address? – Greg Sep 17 '14 at 11:55
  • @Amiramix Legitimate bounces always have the sender set to `<>` in order to prevent bounce loops. – kasperd Sep 17 '14 at 20:29