Page MenuHomePhabricator

Harden mail server against incoming spam
Closed, ResolvedPublic

Description

Currently, the mail queue has a handful of outgoing bounces that relate to mails to user@tools.wmflabs.org (an existing mail address) that were tried to be forwarded to that user's address, but didn't succeed.

The problem with that is that the recipients of those bounces (i. e. the senders of the incoming mails) are from non-existing domains and/or users.

The mails are in Chinese and contain spreadsheet attachments. User "user" seems to be Chinese, but my gut tells me that this is spam.

So before we become the target of more of that, we should harden the mail server so that it only accepts mail from domains that actually resolve (and/or other similar anti-spam best practices for exim).


Version: unspecified
Severity: enhancement

Details

Reference
bz65629

Event Timeline

bzimport raised the priority of this task from to Needs Triage.Nov 22 2014, 3:14 AM
bzimport added a project: Toolforge.
bzimport set Reference to bz65629.

(In reply to Tim Landscheidt from comment #0)

The mails are in Chinese and contain spreadsheet attachments. User "user"
seems to be Chinese, but my gut tells me that this is spam.

Confirming.

coren removed coren as the assignee of this task.Mar 25 2015, 2:43 PM
coren triaged this task as Low priority.
coren set Security to None.

Running Spamassasin (or an equivalent) on the MX is a possibility, but the risk of false positives remains. This requires further evaluation of possible solutions.

I think requiring valid DNS entries should be quite enough for a while.

bd808 assigned this task to GTirloni.
bd808 subscribed.

DNSBL checks added as part of T208579: tools-mail: Migrate to Stretch