PSA: Avoiding spam-scanning outgoing mailman3 mail
So I integrated SpamAssassin into my mailman3 server the other day, using the ubuntu packages which implement the “standard” SpamAssassin install with a filter on port 25 and re-injection using /usr/sbin/sendmail.
From postfix/master.cf:
# ========================================================================== # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (yes) (never) (100) # ========================================================================== smtp inet n - n - 10 smtpd -o content_filter=spamassassin
spamassassin unix - n n - - pipe user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}
The problem there, of course, is that mailman3 traffic gets scanned twice: once on the way in from the original sender and once on the way out as mailman3 duplicates it to list recipients. This is because out-of-the-box mailman3 tends to be configured to re-inject list email via port 25, which is scanning for spam on incoming email. This is horribly inefficient, obviously, and gets worse the bigger your mailing list is. Given that it’s written in Perl, SpamAssassin isn’t the most efficient thing in the first place.
Anyway, I got literally zero hits on solving this when I googled it, so here’s mine to save future mailman3+SpamAssassin users some grief.
The easy fix was to edit the [mta] setting in mailman.cfg to deliver email via the submit port instead, which has no filtering applied to it:
smtp_host: localhost # using the submit port bypasses spamassassin filtering on outgoing list email smtp_port: 587 smtp_user: mm3send <— I created this user for this purpose smtp_pass: <password-for-mm3send-user>
This works great and can be applied to any email filtering.
FYI.
- Mark
mark@pdc-racing.net | 408-348-2878
On 5/8/20 2:11 PM, Mark Dadgar wrote:
The easy fix was to edit the [mta] setting in mailman.cfg to deliver email via the submit port instead, which has no filtering applied to it:
smtp_host: localhost # using the submit port bypasses spamassassin filtering on outgoing list email smtp_port: 587 smtp_user: mm3send <— I created this user for this purpose smtp_pass: <password-for-mm3send-user>
This works great and can be applied to any email filtering.
We tend to do this differently. For example, on mail.python.org which currently has 261 Mailman 2.1 lists and 134 Mailman 3 lists and sends about 135,000 individual messages per day from the two Mailman instances, we define in /etc/postfix/master.cf
127.0.0.1:8026 inet n - - - - smtpd -o smtpd_authorized_xforward_hosts=127.0.0.0/8 -o mynetworks=127.0.0.0/8 -o smtpd_recipient_restrictions=permit_mynetworks,reject -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_data_restrictions= -o receive_override_options=no_unknown_recipient_checks -o smtpd_milters=inet:127.0.0.1:8891
Then port 8026 only accepts locally generated mail and only does dkim signing (milter on port 8891) and essentially no other checks.
Then in the [mta] section in mailman.cfg we only need
smtp_port: 8026
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
On May 8, 2020, at 3:20 PM, Mark Sapiro <mark@msapiro.net> wrote:
We tend to do this differently. For example, on mail.python.org which currently has 261 Mailman 2.1 lists and 134 Mailman 3 lists and sends about 135,000 individual messages per day from the two Mailman instances, we define in /etc/postfix/master.cf
127.0.0.1:8026 inet n - - - - smtpd -o smtpd_authorized_xforward_hosts=127.0.0.0/8 -o mynetworks=127.0.0.0/8 -o smtpd_recipient_restrictions=permit_mynetworks,reject -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_data_restrictions= -o receive_override_options=no_unknown_recipient_checks -o smtpd_milters=inet:127.0.0.1:8891
Then port 8026 only accepts locally generated mail and only does dkim signing (milter on port 8891) and essentially no other checks.
Then in the [mta] section in mailman.cfg we only need
smtp_port: 8026
Yep - I used to do something similar back when I was running dspam with mm2.1. This is a slightly more complicated to set up, but cleaner.
- Mark
mark@pdc-racing.net | 408-348-2878
participants (2)
-
Mark Dadgar
-
Mark Sapiro