How can I block all emails arriving from a domain?

[plittlefield]

Each day I get spam emails from one particular domain and move them to my Junk folder in Thunderbird for DMS to scan overnight.

They keep coming and don't get flagged as Spam.

Is there a way to add a domain to a reject list so they just don't even get that far?

[polarathene]

These discussions might be of interest to you:

• https://github.com/orgs/docker-mailserver/discussions/3624#discussioncomment-7514981
• https://github.com/orgs/docker-mailserver/discussions/4527

The first link better details our setup email restrict add send [email protected] command (it should also work with just example.com instead of [email protected] I think), which Postfix should check when it receives mail and allow you to reject by the sender address used.

I'm pretty sure in one of those links I covered the technical details of the feature and Postfix config quite well. It should work for both mail arriving to DMS on port 25 as well as being sent through ports 465/587 (if wanting to prevent what your own mail accounts can use for the sender/recipient addresses).

---

Out of curiosity with your current DMS setup, have you enabled SpamAssassin or Rspamd? Both are disabled by default while Amavis is enabled but for proper spam filtering it requires SpamAssassin to be enabled AFAIK.

We would like to move to Rspamd as the default in a future release of DMS, so ideally it would work well for you at catching spam without having to manage it with a custom filtered list to reject mail 😅

[plittlefield]

Oh my word, that is brilliant!

docker exec -it mailserver setup email restrict add send @computersproductsonline.co.uk

Thank you so much for a quick and detailed reply, as well as a great mail server solution.

[plittlefield]

Well, I spoke too soon - emails are still getting through :-(

2025-08-11T10:08:41.041369+01:00 mail postfix/smtpd[600158]: 09BF0FB1B5: client=box.computersproductsonline.co.uk[216.245.140.37]
2025-08-11T10:08:41.050192+01:00 mail postfix/cleanup[600166]: 09BF0FB1B5: message-id=<[email protected]>
2025-08-11T10:08:41.088066+01:00 mail opendkim[1143]: 09BF0FB1B5: box.computersproductsonline.co.uk [216.245.140.37] not internal
2025-08-11T10:08:41.120629+01:00 mail opendkim[1143]: 09BF0FB1B5: s=mail d=computersproductsonline.co.uk a=rsa-sha256 SSL
2025-08-11T10:08:41.176223+01:00 mail opendmarc[1152]: 09BF0FB1B5: computersproductsonline.co.uk pass
2025-08-11T10:08:41.222434+01:00 mail postfix/smtpd[600158]: disconnect from box.computersproductsonline.co.uk[216.245.140.37] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
2025-08-11T10:08:41.223460+01:00 mail postfix/qmgr[122833]: 09BF0FB1B5: from=<[email protected]>, size=29021, nrcpt=1 (queue active)
2025-08-11T10:08:42.015697+01:00 mail postfix/cleanup[600166]: 02D8AFB1B6: message-id=<[email protected]>
2025-08-11T10:08:42.021312+01:00 mail postfix/qmgr[122833]: 02D8AFB1B6: from=<[email protected]>, size=29712, nrcpt=1 (queue active)
2025-08-11T10:08:42.027189+01:00 mail amavis[580533]: (580533-06) Passed CLEAN {RelayedInbound}, [216.245.140.37]:43819 [216.245.140.37] <[email protected]> -> <[email protected]>, Queue-ID: 09BF0FB1B5, Message-ID: <[email protected]>, mail_id: twR5aV6LTY35, Hits: 5.444, size: 28870, queued_as: 02D8AFB1B6, 780 ms
2025-08-11T10:08:42.178492+01:00 mail dovecot: lmtp([email protected])<600174><xtSpAxqzmWhuKAkAGHC/dw>: sieve: msgid=<[email protected]>: stored mail into mailbox 'INBOX'

This is the postfix-send-access.cf file contents ...

$ (screen) cat /root/docker/stacks/mailserver/data/config/postfix-send-access.cf 
@computersproductsonline.co.uk           REJECT

What have I done wrong?

Is there a way to block the helo request ?

Paully

[casperklein]

With user-patches.sh, you can also use postfix's header checks:

# DISCARD/REJECT mails based on header
# http://www.postfix.org/header_checks.5.html
echo '/^Subject:.*Invest In Bitcoin.*/          DISCARD spam' >> /etc/postfix/maps/header_checks.pcre

Instead of the "Subject" line, you can also use the "From" line:

echo '/^FROM:.*<[email protected]>/          DISCARD spam-domain' >> /etc/postfix/maps/header_checks.pcre

This should block mails from *@example.com (not tested).

[plittlefield]

Thanks. Let me see how the fail2ban works and if it doesn't I will try that next!

[casperklein]

The above should also work, if the IP changes in the future 👍

[polarathene]

As a reminder my previous answer to you did end with a question about your anti-spam config.

If setup properly it should ideally be catching unwanted spam mail, but you need to opt-in to either SpamAssassin or Rspamd (until this becomes the new default, you'd need to follow advice at our docs for switching from Amavis + SpamAssassin).

---

Well, I spoke too soon - emails are still getting through :-(

AFAIK, these restrictions that are configured should be processed before content_filter is used (calls to Amavis).

Are you sure that you configured the right domain-part to block on? smtpd_sender_restrictions matches for MAIL FROM (envelope sender address), so you might have actually wanted this to be @box.computersproductsonline.co.uk if it differed from the FROM header (sender address indicated in the mail which is sometimes spoofed to a different address).

Maybe that's why it didn't work? 🤔

[polarathene]

Is there a way to block the helo request ?

Yes you can apply restrictions for mail arriving at an earlier stage, such as when checking HELO.

As detailed in this reference discussion comment of mine, the implementation to configure Postfix is fairly straight-forward, so while the setup email restrict CLI lacks support for it, you could manually implement restrictions for the earlier HELO stage with the smtpd_helo_restrictions Postfix setting configuring check_helo_access to a similar config file that the setup email restrict CLI support would have generated.

In the 2nd discussion comment I linked I provide an example reference for how you'd go about this sort of customization with DMS. So check that for details, but adapted to your use-case you'd leverage our user-patches.sh feature like this~in your compose.yaml (or with a separate user-patches.sh file):

services:
  dms:
    configs:
      - source: script-custom-restrictions
        target: /tmp/docker-mailserver/user-patches.sh
      - source: access-helo
        target: /tmp/docker-mailserver/my-configs/access-helo.cf

configs:
  script-custom-restrictions:
    content: |
      #!/bin/bash

      HELO_ACCESS_CF='check_helo_access texthash:/tmp/docker-mailserver/my-configs/access-helo.cf'
      # Prepends `check_helo_access` for port 25 by editing `/etc/postfix/main.cf` in-place:
      sed -i -E 's|^(smtpd_helo_restrictions =)|\1 ${HELO_ACCESS_CF},|' /etc/postfix/main.cf

  # Same config format used by the other restrictions (<pattern> <action>):
  access-helo:
    content: |
      box.computersproductsonline.co.uk  REJECT

That should update our Postfix main.cf config for that setting:

docker-mailserver/target/postfix/main.cf

Line 55 in fcd9909

smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, permit

---

I think that's configured how you'd want it, or as per the discussion comment link, you might be wanting to configure with the example there for smtpd_client_restrictions, since that's clearly the value Postfix is reporting as the first log value:

client=box.computersproductsonline.co.uk[216.245.140.37]

[plittlefield]

Thanks everyone for your great replies.

I shall report back with my findings in a week or so.