Trying to understand some email issues

[Odhiambo Washington]

On Mon, 21 Jan 2019 at 09:35, Patrick Mahan <plmahan at gmail.com> wrote:

> All,
>
> FreeBSD 11.2
>
> Running postfix 3.3.2_1,1
>
> I'm getting hammered with thousands of emails from yahoo.com -
>
> Here is an example -
>
> Jan 20 22:09:01 ns postfix/smtp[1308]: 2DA97A2E2EF: to=<pwascak at aol.com>,
> relay=mx-aol.mail.gm0.yahoodns.net[98.137.157.43]:25, delay=13730,
> delays=13728/0.31/1.1/0.06, dsn=4.7.0, status=deferred (host
> mx-aol.mail.gm0.yahoodns.net[98.137.157.43] said: 421 4.7.0 [TSS04]
> Messages from 23.24.207.145 temporarily deferred due to user complaints -
> 4.16.55.1; see https://help.yahoo.com/kb/postmaster/SLN3434.html (in reply
> to MAIL FROM command))
>
> I'm trying to determine if I am somehow relaying emails to yahoo.com, or
> is
> this someone attacking me.
>

Your server's public IP address is  23.24.207.145, right?
Yahoo MX is "temporarily" (that is what SMTP Error Code 451 is. Code 550 is
"permanently")
rejecting mail from your server.
This is normal with Yahoo and you need to go to the given URL to understand
why and possible
ways of mitigating the issue.
The thing is that ultimately, after some retries, Yahoo servers may accept
the mail.
You need to check your Postfix logs for this particular, or other such
emails to see if they are
originated by your legit users/IPs.



> I am pretty sure I have postfix to avoid acting like a relay for
> unauthenticated connections.  But this maybe something I have messed up.
> This has been happening only since I upgraded to 11.2 (I was at 9.x).  I
> also just recently switch from sendmail to postfix as well.
>

You just need to sit down and read Postfix documentation and understand
it's internals,
especially the logs. Without a clear understanding of the logs, you should
be very worried
as a Mail SysAdmin, very worried! :-)
I am NOT a Postfix Admin, but I understand some stuff about it. I use Exim
as my preferred MTA.


> I can provide my postfix config on request if needed.
>

Not necessary for this case.
However, I would advise you to sit easy if you followed a proper howto in
setting up your MTA.
Just take your time now to read about and understand the logging.


>
> Pointers to other mail-lists are welcomed.  I decided to start here before
> jumping on the postfix mailing list.
>
> No problem.


-- 
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
"Oh, the cruft.", grep ^[^#] :-)