Advice on how to handle NDR and DSN Attack

SmegTheLight

Using Postfix2.5.2/Amavis-New/Spamassassin/Clamd

About 10 hours ago, one of our email accounts became the unwitting "From" line for some spammer of the day.
Since then, the NDR/DSN bounce messages have been flooding in at about 200-300 / minute.

We've had this in the past, but nothing of this scale.

Using postfix, I have blocked the email address in question, but that is preventing ALL mail from making it in.

I have checked out the Postfix Backscatter howto at http://www.postfix.org/BACKSCATTER_README.html, but the header/body checks there only work if someone is actually trying to pretend to be you. Everything would work great if all the mail servers blocked SENDING NDR/DSN's back from blatantly bogus server, but they don't - none of the "received froms" even have a portion of my domain in them.

It looks like I am going to have to try and figure out a funky regex to reject everything EXCEPT the valid "received from"..Argh !!

I realize I am stuck with the traffic and extra load on the servers until the storm hopefully passes,
but does anyone have any other ideas to filter out the crap bounce messages so at least some normal mail can make it in ?

SeaTiger · Posted: Wed Oct 08, 2008 1:42 am Post subject:

Do you have rbl client in your main.cf?

SmegTheLight · Posted: Wed Oct 08, 2008 3:21 am Post subject:

I have reject_rbl_client zen.spamhaus.org in my smtpd_recipient_restrictions.

This isn't just idle spam trying to get to me as a delivery failure notice, but actual delivery failure notices from what looks like many thousands of legitimate, though poorly configured mail hosts.

I have just added the blocklist from http://www.backscatterer.org and it is helping a bit.

SeaTiger · Posted: Wed Oct 08, 2008 4:44 am Post subject:

Thank you! Actually you help me in return. I wasn't using backscatterer before.

Well, my company server used to get like 30k to 40k junk email connections base on logwatch, which were all blocked by rbl. And will rbl, as long as they are blocked, the server don't have much load since the connection is actaully dropped, therefore the actual junk mail don't come in at all. That saved lots of bandwidth too. The only side effect is that my logwatch email is looooooooooong