Hey, just a few tips I’ve been trying out for this kind of spam:
- For messages with no To:/Cc: headers, dropping them at the Postfix level works well if you only use reply-by-email.
- You can also add a simple SPF/DKIM check to filter out spoofed domains before they hit Discourse.
- Another trick I’ve seen is rate-limiting incoming mail per IP or per sender domain — it helps slow down spam waves without touching normal users.
- If you’re feeling adventurous, combining header checks with a small whitelist (for trusted senders or mailing lists) can cut down false positives.
Nothing fancy, just some ideas that have helped me reduce the noise a bit 