I am getting annoying mail spam to non-existent addresses at my site. It of course fails, but it clogs up the logs. Since I don’t have the source IP addresses, is there any way I can block email by source address? I know they keep jumping around, but I am looking for suggestions. My Discourse is self hosted.
AI-generated summary
The discussion revolves around blocking email spammers on a self-hosted Discourse site. Andro is experiencing spam emails clogging up their logs and is seeking ways to block emails by source address, even though the spammers keep changing IP addresses. Lilly shared a helpful topic about filtering known bad sender domains from the mail receiver.
md-misko suggested using commands to filter spammer IP addresses from the logs and provided instructions on how to configure the mail-receiver to block spam. However, Ed_S warned against using blocking measures, citing the risk of losing valid input from real people, and instead recommends tolerating some invalid input to ensure no legitimate contributions are lost.
this topic may help if you haven’t seen it yet:
You can filter most spammer IP addresses from the logs using this command (it’s not strictly a RFC requirement, but almost all spam relays don’t have a valid PTR)
./launcher logs mail-receiver | grep -v 'unknown' | grep -E 'NOQUEUE'
If you are getting spam from seemingly legit server it is still difficult to block senders using an email domain, as it can be easily spoofed, so your best bet is to find the IP of the sending SMTP server and block it
./launcher logs mail-receiver | grep -E '[0-9A-F]{10,}:.+(from=<[^>]|client=)'
First result in a pair will give you a SMTP server IP, and the second one will give you a sender address.
You can use the instructions described in
to configure the mail-receiver. I’ve eliminated almost all spam using this approach.
That sounds like a minor administrative inconvenience - compare it to the impact of a less-than-perfect block preventing a real person from making a real contribution to your forum. Personally, I wouldn’t use any kind of blocking, because I never want to lose valid input, even if the cost is that I get some invalid input.