postfix forwarding mails getting bounced back to original sender

Question

I am using postfix as mail server for "myDomain.com". Further I have installed a forwarding service to gmail. That works fine so far. But when someone sends me an e-mail with e.g. an executable, gmail bounces the mail. This notification mail from gmail will be relayed to the original sender, but not to me. What I want to accomplish:

• "A" sends an executable to my address at "myDomain.com".
• The email will be forwarded to gmail. -> gmail bounces the mail back with a notification.
• I want to receive this bounced email in my mailbox at "myDomain.com".
• the original sender "A" doesn't get anything from gmail.

Any ideas at how to accomplish that? Thank You!

Answer 1

• The email will be forwarded to gmail. -> gmail bounces the mail back with a notification.

• I want to receive this bounced email in my mailbox at "myDomain.com".

• the original sender "A" doesn't get anything from gmail.

Gmail is not sending a bounce to the original sender.

The communications flow is like this:

Step 1: Original sender mail server communicates with your server (lets call it mx.example.com)

HELO originalsendermx
250 mx.example.com
MAIL FROM: originalsender@spammy.example
250 2.1.0 Ok
RCPT TO: a@example.com
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Subject: this is a virus in an executable for a@example.com
<base64encodedvirusexe>
.
250 2.0.0 Ok: queued as C9F786427FA
QUIT
221 2.0.0 Bye

Step 2: your postfix server has a rule to forward all mail to a@example.com to b@example.org, so it connects to mx.example.org:

HELO mx.example.com
250 mx.example.org
MAIL FROM originalsender@spammy.example
250 2.1.0 Ok
RCPT TO: b@example.org
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Subject: this is a virus in an executable for a@example.com
<base64encodedvirusexe>
.
550 5.2.3 The content of this message is not allowed
QUIT
221 2.0.0 Bye

So your server accepted the mail from original sender, but example.org (or gmail in your case) didn't accept the mail from your server. According to RFC 2821 your server should generate a Non-Delivery notification and send it to original sender:

If an SMTP server has accepted the task of relaying the mail and later finds that the destination is incorrect or that the mail cannot be delivered for some other reason, then it MUST construct an "undeliverable mail" notification message and send it to the originator of the undeliverable mail.

And this is the default behaviour of postfix. OTOH, common sense dictates you shouldn't send a bounce in this situation, and RFC5321 agrees.

The fastest way to accomplish this would be to modify master.cf to never send bounces:

bounce    unix  -       -       n       -       0       discard

But it's a little extreme and probably undoable in many environments. You could use header_checks to narrow it down a little.

The important bit is that gmail isn't bouncing anything, it's just rejecting it. Your server is the one bouncing it.

Answer 2

I've had more or less the same problem; I've noticed that Gmail uses the SMTP response code 421 in this case. Since it's not a 5xx code, that means that the mail is queued for a later retry and sits in the deferred queue. So I built a cronjob to clear these mails out of the queue every hour, running the following command:

mailq | egrep -i -B 1 'google.com.*421-4.7.0.*gsmtp' | egrep -v '^\(|--' | cut -d' ' -f1 | postsuper -v -d -

Exact error message format may vary, but 421-4.7.0 seems to be the common denominator.