How to get all your mail going out of one IP address with POSTFIX

If you have multiple IPs (ETH0,ETH0:0, etc) running on a server with Postfix, chances are you are going to run into the problem of Postfix not using the mail IP that has the matching MX record to send mail.

When this happens most of the mail servers will label your mail as SPAM and/or reject it.

You can force Postfix to use the main servers IP address by adding the following lines to your /etc/postfix/main.cf:
smtp_bind_address = 1.1.1.1

*You would replace 1.1.1.1 with the main IP of your own server.
Restart Postfix with /etc/init.d/postfix restart

This might cause your mail to backup on the server if your have other services  that might need a configuration tweak to continue working correctly, check your mail queue with this:
postqueue -p

If you see mail backing up in that queue for failed connections to 127.0.0.1, then you might have to start making some tweaks. If not, then you should be OK.


If you have AMAVIS running on the server then you might need to make this tweak for AMAVIS to properly work. Create the file /etc/amavis/conf.d/60-custom. Add the following line:
@inet_acl = qw( 127.0.0.1 [::1] 1.1.1.1 );

Restart AMAVIS with /etc/init.d/amavis restart

Now check the Postfix queue with postqueue -p again. If there is any mail still there try flushing it out with postqueue -f. The recheck it after a couple of seconds with postqueue -p again. It should be all gone now.

Binding postfix to use a specific ip address.

Now-a-days with SPF records and such, it's always a good idea to limit postfix to use the ip address specified in the spf record to prevent your mail from being marked as spam. This is only necessary if your server has more that one ip bound to it. 

In /etc/postfix/main.cf add:
smtp_bind_address = 111.222.333.444

This will limit your postfix server to using the ip specified.

Postfix management / Mail administrator primer

I thought I'd write a little primer with some of the most important commands you will use as a mail administrator.

Most servers will use postfix. So I will concentrate on postfix centric commands.

How to check your mail queue:
# postqueue -p

This will all mail that is in the queue waiting to be delivered. This is usually the first place I go to check if someone is sending spam from my server.

Once you find a domain that is sending out spam, you should probably stop your mail server.

Shutdown postfix:
# /etc/init.d/postfix stop

At this point you should probably "plug the hole". What I mean by that is that you should locate the compromised email account and change the password, and notify the user.

If is being generated by the site itself, it will usually say the mail is from "PHPMAILFUNCTION@xzy.com". In that case, you will need to contact the site administrator for that site, and disable the MAIL function in the .htaccess file (if your server supports it).

One you plug the hole, you'll want to delete all the mail in the queue that is coming from that site. Use the following command (replacing example.com with the offending domain):

# find /var/spool/postfix/* -type f -exec grep -irl "example.com" {} \; -exec rm -vf {} \;

Re-run # postqueue -p to double-check you've got it all.

Once you are satisfied your eliminated all the spam in the queues, you can restart the mail server with:
# /etc/init.d/postfix start

That's it, you are good to go. Next I will write an article about accessing the damage done to your IP reputation.

Warning: Database file needs update - warning: /etc/aliases, line 2: record is in "key: value" format; is this an alias file?

I was investigating an error that I commonly receive in Logwatch every morning.

        2   *Warning: Database file needs update ----------------------------------------------------
        2      /etc/aliases

So I did what any normal person would do and GREPed the logs and ended up with this error:

/var/log/syslog:Jul 30 07:49:41 mx postfix/postmap[11224]: warning: /etc/aliases, line 2: record is in "key: value" format; is this an alias file?

So I did what any admin would do and ran newaliases, however that produced this error:

/var/log/syslog.1:Jul 29 17:03:48 mx postfix/smtpd[4062]: warning: database /etc/aliases.db is older than source file /etc/aliases

So after doing several Google searches I ended up finding a forum that gave me running this as a solution:

postalias /etc/aliases

That seemed to fix the problem. I could run newaliases after than without any error.

How limit postfix from sending email certain domains in Debian Squeeze

Well all know those certain users that you know they got that job because they are related to someone. And, most of them tend to send mail to made up domains.

This is how to limit them from sending to domains that don't exist.

Open up:
nano /etc/postfix/maps/header_checks

Add the following line per your requirements:
/^To:.*@hotmail\.com\.mx/ REJECT This domain does not exist.
/^To:.*@gmail\.com\.mx/ REJECT This domain does not exist.

You can easily change To: to From: and block receiving emails from those domains as well.

Here is a guide that might help you with other things you might want to block: http://www.akadia.com/services/postfix_uce.html