AkurAI-Mail / scripts/ops/README-edge-antispam.md

Latest change e0753e49bfea7ef672aabf8df9a3a27b8bdd9dc7 - Recover EC2-only ops scripts, checks and live divergent copies by Ólafur Búi Ólafsson

# Edge anti-spam: HELO/rDNS hygiene (t_8907b772)

Split from epic t_e7d0dd61. This card had two halves: Spamhaus DQS +
postscreen DNSBL scoring, and HELO/rDNS hygiene. **Only the HELO/rDNS half
shipped.**

## Why DQS was skipped

Spamhaus DQS requires a free account signup. The card explicitly says: "if
the right email/account is not obvious, comment on this card and block
rather than guessing" — signup needs a decision about which
email/account to register under, which is not inferrable from the repo or
board. Rather than guess an account, this change ships the HELO/rDNS
restrictions only, per the card's own stated fallback ("If the DQS key
cannot be obtained, ship the HELO/rDNS half and say so").

Postscreen itself is also not enabled on this host today (`master.cf` has
the `smtp`→`postscreen` split commented out, `postscreen_dnsbl_sites` is
empty, `postscreen_dnsbl_action = ignore`). Turning postscreen on is a
structural `master.cf` change that only makes sense together with a real
DNSBL zone list (DQS or otherwise); doing it without a working DNSBL would
add no protection and add risk. That work stays with a Spamhaus DQS
account decision, not with this change.

## What changed (mail EC2, `/etc/postfix/main.cf`)

All four values below were already present as `warn_if_reject` (i.e.
warn-mode) or `no` before this change, so real warn-mode log evidence was
already available before any enforcement:

| Setting | Before | After |
|---|---|---|
| `smtpd_helo_required` | `no` | `yes` |
| `smtpd_helo_restrictions` | `warn_if_reject reject_invalid_helo_hostname, warn_if_reject reject_non_fqdn_helo_hostname` | `reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname` |
| `smtpd_client_restrictions` | `warn_if_reject reject_unknown_reverse_client_hostname` | `reject_unknown_reverse_client_hostname` |

Each restriction was enforced one at a time (`postconf -e`, `postfix
check`, `postfix reload`), with a real end-to-end delivery test (SMTP
`EHLO`/`MAIL`/`RCPT`/`DATA` from the host into an LMTP-delivered INBOX)
after each step, confirmed by `status=sent` in the mail log.

## Warn-mode evidence reviewed before enforcing

14-day `postfix/smtpd` journal sample (`journalctl -t postfix/smtpd --since
'-14 days'`), reviewed before flipping any restriction from warn to reject:

- All external `client=` hosts that were ever accepted for delivery had
  valid PTR records and resolved with a normal FQDN: Amazon SES
  (`*.smtp-out.amazonses.com`), SendGrid (`*.outbound-mail.sendgrid.net`),
  Mailgun (`*.send.mailgun.net`), Mandrill (`mail145-141.atl61.mandrillapp.com`),
  Shopify, Podbean, Backblaze, Apple, 1984.is, stefna.is, hysing.is, and
  the operator's own Google Fiber/Cloud reverse DNS ranges.
- Every `warning:` line the sample produced for HELO/rDNS came from clearly
  malicious traffic: forged-sender attempts on `olibuijr@olibuijr.com`
  from IPs with no/garbage PTR (`b129.entelchile.net`,
  `undefined.hostname.localhost`), relay-abuse probes with throwaway HELOs
  (`D-113`, `tonynew`, `egyptian`, random strings from `45.225.135.11`),
  and vulnerability scanners (`scan.visionheight.com`,
  `scan-*.shadowserver.io`) issuing bogus HELO/non-SMTP traffic.
- **False-positive assessment: none found.** No accepted/legitimate sender
  in the 14-day sample ever triggered a HELO or reverse-DNS warning; every
  warning line traces to scanning or forgery traffic. This is why all
  three restrictions above were enforced in the same session rather than
  soaking longer in warn mode — the existing warn-mode history already
  covers a full two-week window with zero false positives.

## Delivery verification (real messages, not synthetic)

After every enforce step a real SMTP session
(`EHLO`→`MAIL FROM`→`RCPT TO`→`DATA`) was run against
`mail.olibuijr.com:25` with a normal FQDN-shaped HELO, addressed to
`postmaster@olibuijr.com`, and each one is confirmed delivered by the
Postfix/LMTP log line `status=sent (250 2.0.0 ... Saved)`:

1. After `smtpd_helo_required = yes` → queued `474A3862F9`, delivered.
2. After enforcing `reject_non_fqdn_helo_hostname` → queued `9906785F5D`, delivered.
3. After enforcing `reject_invalid_helo_hostname` → queued `46D29862F9`, delivered.
4. After enforcing `reject_unknown_reverse_client_hostname` → queued `4D10685F5D`, delivered.

## Rollback

Each restriction can be independently reverted with `postconf -e` +
`postfix check` + `postfix reload`:

```
# revert smtpd_helo_required
sudo postconf -e "smtpd_helo_required = no"

# revert HELO restrictions to warn mode
sudo postconf -e "smtpd_helo_restrictions = warn_if_reject reject_invalid_helo_hostname, warn_if_reject reject_non_fqdn_helo_hostname"

# revert reverse-DNS restriction to warn mode
sudo postconf -e "smtpd_client_restrictions = warn_if_reject reject_unknown_reverse_client_hostname"

sudo postfix check && sudo postfix reload
```

`postfix check` passed before every reload in this change; no `master.cf`
changes were made.

## Remaining work (not in this change)

Spamhaus DQS + postscreen DNSBL scoring — needs a DQS account decision.
Recorded as a follow-up card rather than guessed.