Postfix - antispam and relay package

  • Hello,

    I must say I am glad to see this package. Mail proxies and mail forwarders with filtering is a must have these days. I am new to this package and was wondering if there is any documentation on how to configure and set it up for use. Some of the setting are unclear to me.

    I am not sure what the binding setting is for the WAN, LAN, and loopback and can't find anything that explains it better or what basic settings should be set to. Also, when I removed my SMTP port forward form NAT and rules to use this package, I am having trouble recieving mails. I went to and did a diagnostics test and I don't get a header response or anything. It just says host times out from inactivity.

    I really did not change any of the default setting from the install and yes I did add the domain with a forwarding internal address.

    Could someone help or post a basic setup that would get this working. It is a little hard to figure settings with no documentation or explinations of settings.



  • at has some info but not so detailed.

    the basic setup is:

    • remove nat from port 25

    • create a wan rule to permit smtp traffic to wan address

    • check enable postfix option

    • choose at least wan loopback interfaces

    • fill your domain/internal smtp info

    Many options has recommend, default and link option to postfix documentation.

    I recommend enable all antispam settings too.

    Marcello Coutinho

  • Hey thanks very much for the info. I will give a try. I really like the concept of this package and have waited a while to see something like this come out for pfsense, so thanks for all your hard work.

    I do have one question for your response. When you say WAN loopback interface, do you mean select the WAN interface only, the loopback interface only, or both?

    Thanks Again,

  • So I have e-mails forwarding ok now and thanks for the basic info for that. Just curious, as I seen in early to mid last month a post you made about mailscanner, and was wondering if this will become part of the base install of the postfix forwarder package?

    Currently I am unsure how to implement this ability and not really sure on what the ACLs/Filter maps tab does.

    If you made this package an all inclusive install with all the components needed for a full SMTP filter, that would be sweet.


  • Mailscanner + spamassassin will be released soon as a new package with more then 500 options to filter spam. As I told in other posts, I'm waiting Mailscanner package compilation by core team. But if you know how mailscanner works you can add freebsd package and configure it.

    Can you feedback in % how postfix + all antispam settings reduced spam messages on mailboxes?

  • Yeah, I will post some stats in a about a week. I will compare report files from our other filtering system and see what a rough % in reduction maybe. I can say that I have noticed a difference already just from last night when I enabled it. I am seeing a lot of RBLS blocks and invalide host address blocks. Normally this would get cought by our other filter, but not always for some reason.

    For the most part, it seems to be working very well and I am excited for the Mailscanner package.

    I have been playing around with the ACLs/Filter Maps section and was wondering if a manual blacklist block and whitelist allow will be added?


  • The ACLs allow you to block or permit ips, subjects, atachments and Also filter message body.

    Take a look at samples below each field.

  • Ahhh yes, I am starting to understand how you are laying this out. This all makes sense now. I guess I have just been getting to use to check boxes and enable buttons way to much LOL.

    Thanks again for the info.

    Take Care


  • hello


    I can confirm you this module can function as a relay host, thatis I work as an SMTP forwarder to an external mail Server using STARTTLS

    I congratulate you for your great support for this great pauqete, Proxies and redirects mail, I'm new in this package I would like know if there is some configuration information, as a forwarder (SMTP) mail to an external Server "Outbound Relay Hosts"

    Could anyone help me with the basic configuration to work as mail forwarder to an external server authentication through a little priest specified. It's a bit difficult to understand the configuration without documentation or configuration give some tics.

    thanks for your collaboration

  • mauricioniñoavella,

    The basic setup is already in this topic.,40622.msg217539.html#msg217539

    All features in postfix forwarder package was include after many hours reading official postfix documentation.

    Many features in this packages, has samples or direct links to postfix website, take a look.

    Also you have the options to see the result of gui setup in View confi files tab.

    Some docs about SASL say that are many implementations for it in postfix, now I'm trying to find one compatible with pfsense.

    see considerations on enabling TLS

  • marcelloc

    I have a e-mail that seems to be getting blocked, which I think is a false positive. Here is the log I get back. Note that I removed the actual domain name and IP.

    postfix/smtpd[32719]: NOQUEUE: reject: RCPT from[XXX.XXX.XXX.XXX]: 450 4.7.1 <ex02.example.local>: Helo command rejected: Host not found; from= someone@example.orgto= someone@mydomain.comproto=ESMTP helo= <ex02.example.local>I added this filter rule in the header to allow. This did not seem to work, but when I added a different rule to REJECT a different domain name, it worked.

    /^From:.* OK

    Any idea on this?



  • The host that remote server announce on Helo smtp command Does not exist.

    This is one of the header verification tests.

  • Hi all,

    Postfix compilation on x64 now includes cyrus-SASL2 and TLS.

    who need or want to test it, reinstall or remove/install postfix package.

    No changes in gui for this option. Include all your SASL and/or TLS config in custom options

    Marcello Coutinho

  • marcelloc,

    I am getting a lot of these messages and I have seen a lot of them that are from domains and users I know. What can I do to stop these false positives. Here is the message I recieve minus real IP and domain names.

    postfix/smtpd[61721]: NOQUEUE: reject: RCPT from[]: 450 4.7.1 <cnasrv.cna.local>: Helo command rejected: Host not found; from= someone@someonesdomain.comto= user@mydomain.comproto=ESMTP helo=<cnasrv.cna.local></cnasrv.cna.local>/</cnasrv.cna.local>

    Here is my configuration. I have messed around trying to find out what is causing it and had no luck.

    ACL Filter MIME:
    /^name=[^>]*.(com|vbs|js|jse|exe|bat|cmd|vxd|scr|hlp|pif|shs|ini|dll)/ REJECT W do not allow files of type "$3" because of security concerns - "$2" caused the block.
    /^Content-(Disposition|Type):\s+.+?(?:file)?name="?.+?.(386|ad[ept]|drv|em(ai)?l|ex[_e]|xms|{[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}})\b/ REJECT ".$2" file attachment types not allowed

    **ACL Filter CIDR:**My Internal Subnet

    Header Verification = strong

    Zombie Blocker = Enabled with enforce

    After greetins Test= all selected

    Softbounce= enabled

    RBL with =, bl.spamcop.net2, dnslb.local-5,,

    RBL threshold = 1

    SPF Check = Recomended setting

    I have tried litteraly disabling everything and setting head check to basic to see if the messages would pass. I even added rules to the ACL filter list such as /^From:.* OK

    Is there something I can do? Do you have any suggestions?



  • As I told you last post, postfix is very judicious in header checks, so check your DNS server to see if this host announced by remote SMTP does exist or not.

    You can also try to white-list this host in your local RBL and CIDR ACL.

    I have many of these alerts too, but all of them are really spam or 'misconfigured' hosts.

  • marcelloc,

    I am going to assume that they are misconfigured host because I know they are not spam emails.

    I did state I added the /^ OK* in the ACL's Filter in the header section. Does this not whitelist the e-mail or is it just whitelisting only one of the spam checks?

    Also, if I add their domain address to the CIDR allow, wouldn't that allow their mail server to relay off ours according to the text I am reading at the bottom of that form field?



  • Sorry, I meant relay off the pfsense box. My mail server would not act as an open relay.

  • @darklogic:

    I am going to assume that they are misconfigured host because I know they are not spam emails.

    Did you tested name resolution oh the remote host header info?


    Also, if I add their domain address to the CIDR allow, wouldn't that allow their mail server to relay off ours according to the text I am reading at the bottom of that form field?

    When using postscreen, the documentations says(correct me if I'm wrong) that this only prevents blocking.
    When postscreen is disabled, any ip on CIDR allows relay on your server.

    Can you test this with any other external ip?

  • I have been using for testing. One of the domains I am trying to figure out why it is getting blocked is

    When I do a test on for I get the following.

    220 CNASRV.CNA.local Microsoft ESMTP MAIL Service ready at Fri, 21 Oct 2011 12:59:31 -0400

    OK - resolves to
    Warning - Reverse DNS does not match SMTP Banner
    0 seconds - Good on Connection time
    Not an open relay.
    5.335 seconds - Warning on Transaction time



  • How would I go about disabling postscreen just to see if the mails start to come through. I thought I did disable once by simply unselecting the after greeting checks and disabling Zombie Blocker?

  • Can you see that there is a warning for this domain on your test?

    I've made some tests here and has a valid dns entry and it's related as SPF for

    check if your dns has same info and if postfix erros say that worng hostname is or something else.

    If you disable postscreen, the error will remain as it is done in header check.

  • Here is the message minus user email name and our domain name.

    postfix/smtpd[10950]: NOQUEUE: reject: RCPT from[]: 450 4.7.1 <cnasrv.cna.local>: Helo command rejected: Host not found; from= someone@clemansnelson.comto= someone@mydomain.comproto=ESMTP helo= <cnasrv.cna.local>When you say my DNS, our you referring to my internal DNS or external WAN DNS from the firewall?



  • I have spotted about 6 other domains that I know are not spam that is getting the same message above. If I disable the Postfix forwarder and then do a temporary NAT and port forward of SMTP:25 to our internal mail server. The transparent spam filters we have will allow the message through and they do a lot of the same checks. I must have something misconfigured on postfix, or these host are not configured correctly. I am not willing to say something is wrong with the package because we are still getting a lot of good e-mails coming through.

    Up above I posted my base config, can you see anything that would be causing the issue in that config?



  • @darklogic:

    postfix/smtpd[10950]: NOQUEUE: reject: RCPT from[]: 450 4.7.1 <cnasrv.cna.local>: Helo command rejected: Host not found; from= someone@clemansnelson.comto= someone@mydomain.comproto=ESMTP helo= <cnasrv.cna.local></cnasrv.cna.local>/</cnasrv.cna.local>

    The problem is this : helo=<cnasrv.cna.local></cnasrv.cna.local>

    Helo host in smtp negotiaton must exist. If you allow any host in SMTP helo, you are opening your server for a lot of spam.

    Many STMP admins 'foget' to configure their servers, it's normal.

    In any way I suggest you to disable spam checks.


    Note that any client behind a misconfigured server will receive this erros for many domains, so they can forward it to SMTP 'admins'

  • Well, as much as I hated to, I disabled the spam checks and saved, then disabled and saved and then renabled postfix and saved.

    I am still getting the same messages?



  • And about your config, I suggest you to change RBL threshold to 2.

    As I told you, this host error is got by header check, not postscreen.
    See configuration files options in gui.


    #Don't talk to mail systems that don't know their own hostname.
    smtpd_helo_required = yes
    smtpd_helo_restrictions = reject_unknown_helo_hostname

    This is a feature, not a bug or false positive.

    Don't think the problem is with your setup.

  • Ok, I am starting to see now what you are saying. On the main config code you pointed out, Should I change smtpd_helo_required = yes to = no or change smtpd_helo_restrictions = reject_unknown_helo_hostname

    Like you said, I am afraid I will open the gates for flooding of spam. We have transparent backend filters, but I was hoping to kill most of it at the gateway level.

    So what would you suggest at this point. I changed my RBL from 1 to 2.

    Thanks for all your help,


  • Send a email to postmaster@ domains you identify that misconfiguration.

    Or try CIDR with remote SMTPS While using postscreen

  • @darklogic:

    RBL with =, bl.spamcop.net2, dnslb.local-5,,


    Hi. I'm the owner/manager of and the host name you listed above for using as an RBL is WRONG!!!! (I deleted it in my quote of your post.. see post for what I'm talking about)

    Anyone using that host name as an RBL will ONLY get rejected queries. This a waste of other's resources–since anyone adding a bogus RBL only adds wasted time to the processing of each message. Therefore, please edit your post above to remove that reference to invaluement.

    Even if you had the correct host name, it would STILL get blocked because access to invaluement is ONLY available to paying subscribers via RSYNC to rbldnsd files, which are then hosted locally.

    An invaluement subscription is VERY INEXPENSIVE... and locally hosted RBLs on an rbldnsd server are extremely FAST--which helps your filtering to go FASTER and become more scalable--could even save you $$ on hardware upgrades in the future! Subscription information can be found here:

    Thanks and please let me know if you have any questions.

  • marcelloc,

    Can you confirm if that last post from invaluement is true? I noticed they are a new user with that being their first post. Looks a little shady.

    Also I e-mail postmaster at those domains with nothing yet. Also, I am not sure what you were meaning with "Or try CIDR with remote SMTPS While using postscreen"?



  • The Rbl list in package example is just an example for how to configure Rbl list.

    You MUST take care on what list you choose. There is also a link in the package for a lot of Rbl lists, free and paid.

    And about the emails you sent, just be patient. You can also look for other emails on domains web page.

  • I clicked the link, but I am not sure what list are free and which ones are paid?

  • marcelloc,

    I have some new info for you as requested. I have compared the past 3 weeks of SPAM data on our backend SPAM filter reports, and they have been very close from week-to-week of around 650 to 700 SPAM e-mails per week. This past weeks reports since the postfix forwarder package has been installed, has litterally cut that report down to around 190 to 200 SPAM e-mails. This is without any mail scanner or Spamassin added to the postfix forwarder.

    So right now we are seeing about a 300% decrease in SPAM on just the first layer of filtering at the gateway level. Very Nice…

    Any idea on when that mailscanner feature will be added?

  • Great news,

    Looking my logs what I see is that nasty emails like fake domains, virus, phishing, etc are almost 100% blocked with postfix. Comercial mail that has real smtp info can be easly blocked using ACLS.

    Any idea on when that mailscanner feature will be added?

    I think i will release a mailscanner-dev version with freebsd 8.1-release packages to get it working until pfsense packages are done.

    Thanks for your feedback

  • @darklogic:


    Can you confirm if that last post from invaluement is true? I noticed they are a new user with that being their first post. Looks a little shady.

    Here is confirmation. See message to 'darklogic' at the bottom of this page:
    …I couldn't do that if this wasn't legit!

  • I've also included this in Rbl field list info:

    ex:, bl.spamcop.net2, dnslb.local-5,

  • marcelloc,

    I removed the list from my post.

    Also, I am having no luck with those domains that are getting rejected that I know are ok e-mails, but maybe misconfigured servers. I am getting a lot of this and I have had about 5 employees ask if something was wrong with the e-mail system. If I can't figure a way to allow these e-mails, I may have to back away from the postfix package. I really don't want to do that… This is the same issue I have been previously posting about.



  • First of all, it's not a issue with postfix. It's a issue with remote smtp admin.

    Try to include remote server in cidr or call remote admin.

    Here is the link for poscreen documentation about whitelist:
          This test is executed  immediately  after  a  remote  SMTP
          client  connects.  If a client is permanently whitelisted,
          the client will be handed off  immediately  to  a  Postfix
          SMTP server process.

    postscreen_access_list (permit_mynetworks)
                  Permanent white/blacklist for remote SMTP client IP

  • I'm sorry, I didnt mean to sound like I was saying something is wrong with your package. I just don't have any clear way to resolve this issue with so many misconfigured e-mail servers.

    There is little documentation for your package and the docs that are being provided are for a project other than a package for pfsense. If I knew all the ends and outs of this package, I guess I would know the answer, and if I knew the answer on how to configure this mod with little documentation to follow, I guess I might even be able to develope it, but I don't know.

    Even you file states in it, not to modify?

    I like this package, I really want to use it, but the documentation being provided is not for the pfsense package.

    Thanks For All You Help,


  • the link was for postscreen documentation to show you that putting the remote smtp ip in CIDR while using postscreen does not open your server to relay.

    You just step over postscreen and connect direct to postfix daemon where there are other tests.

    Sorry if it seemed offensive, was not my intention.