From 46b90d2a8d93dab5438462f52466ed007cba81f7 Mon Sep 17 00:00:00 2001 From: Mix Date: Fri, 16 Oct 2026 16:22:09 +0300 Subject: [PATCH] design: inbound-upstream-result - held, and a bounce with no return address Findings of the reviews of the row (2026-10-16): a message the filter had held is "held" in the Upstream column - in the queue, not tried until it is released - and not "queued"; and a bounced message is said to have bounced to its sender only when it had a return address (Postfix does not bounce mail from the null sender). The help's Inbound log topic says both. check.py: 0 violations. Co-Authored-By: Claude Opus 5.5 --- docs/assets/panel-redesign/panel/help.html | 2 +- docs/assets/panel-redesign/panel/src/help.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/assets/panel-redesign/panel/help.html b/docs/assets/panel-redesign/panel/help.html index 2d3d596..6e7ef74 100644 --- a/docs/assets/panel-redesign/panel/help.html +++ b/docs/assets/panel-redesign/panel/help.html @@ -137,7 +137,7 @@

Upstream

The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it; Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.

Valid recipients

Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.

Spam filter

The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's .env, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or refused with a temporary error, so the sending server tries again later, as the server's setting says; the box states which.

-

Inbound log

One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: accept — taken for the upstream; reject — refused for good; tempfail — the sender was asked to come back later; quarantine — held by the filter. Why names who decided. rspamd is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; postfix is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; selfpost means nobody judged the message: it was relayed with no filter attached. Upstream says what became of an accepted message: queued — not tried yet; sent — the upstream took it; deferred — the upstream put it off or could not be reached, and Postfix tries again; bounced — the upstream refused it, or it waited in the queue too long, and the sender was sent a bounce. It opens the last reply and the host that gave it. A refused message has no upstream result, and neither has a row logged before 2.10.0.

Accepted mail is recorded as it passes; refused mail is read from mail.log, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.

+

Inbound log

One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: accept — taken for the upstream; reject — refused for good; tempfail — the sender was asked to come back later; quarantine — held by the filter. Why names who decided. rspamd is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; postfix is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; selfpost means nobody judged the message: it was relayed with no filter attached. Upstream says what became of an accepted message: queued — not tried yet; held — held in the queue by the filter, not tried until it is released; sent — the upstream took it; deferred — the upstream put it off or could not be reached, and Postfix tries again; bounced — the upstream refused it, or it waited in the queue too long, and the sender was sent a bounce, if it had a return address. It opens the last reply and the host that gave it. A refused message has no upstream result, and neither has a row logged before 2.10.0.

Accepted mail is recorded as it passes; refused mail is read from mail.log, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.

Filter lists

Two lists for the whole server that correct the spam filter by hand. An entry is a sender address, a sender domain — that domain, not its subdomains — or a client address or network in CIDR form. A sender on the Deny list is refused outright. A sender on the Allow list is given a weight no spam score outweighs, so the filter lets it through. The sender's address is whatever the sending server says it is - anyone can claim to be a sender you allow - so allow a client address or network where you can, and a sender address only for mail you would rather receive forged than lose. When entries of both lists match one message, Deny wins.

SelfPost does not apply the lists itself: it writes them as files under /data/antispam/, and rspamd rereads a file within seconds of a change. With the spam filter off the lists are kept and can be edited, but nothing reads them. The sender matched is the envelope sender — the one in the log — not the From line a mail program shows. Matched counts the messages in the Inbound log that the entry decided, so it reaches back as far as the log does; never means not once in that time, and such an entry is one to consider removing.

diff --git a/docs/assets/panel-redesign/panel/src/help.html b/docs/assets/panel-redesign/panel/src/help.html index f0be335..b411042 100644 --- a/docs/assets/panel-redesign/panel/src/help.html +++ b/docs/assets/panel-redesign/panel/src/help.html @@ -71,7 +71,7 @@

Upstream

The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it; Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.

Valid recipients

Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.

Spam filter

The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's .env, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or refused with a temporary error, so the sending server tries again later, as the server's setting says; the box states which.

-

Inbound log

One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: accept — taken for the upstream; reject — refused for good; tempfail — the sender was asked to come back later; quarantine — held by the filter. Why names who decided. rspamd is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; postfix is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; selfpost means nobody judged the message: it was relayed with no filter attached. Upstream says what became of an accepted message: queued — not tried yet; sent — the upstream took it; deferred — the upstream put it off or could not be reached, and Postfix tries again; bounced — the upstream refused it, or it waited in the queue too long, and the sender was sent a bounce. It opens the last reply and the host that gave it. A refused message has no upstream result, and neither has a row logged before 2.10.0.

Accepted mail is recorded as it passes; refused mail is read from mail.log, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.

+

Inbound log

One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: accept — taken for the upstream; reject — refused for good; tempfail — the sender was asked to come back later; quarantine — held by the filter. Why names who decided. rspamd is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; postfix is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; selfpost means nobody judged the message: it was relayed with no filter attached. Upstream says what became of an accepted message: queued — not tried yet; held — held in the queue by the filter, not tried until it is released; sent — the upstream took it; deferred — the upstream put it off or could not be reached, and Postfix tries again; bounced — the upstream refused it, or it waited in the queue too long, and the sender was sent a bounce, if it had a return address. It opens the last reply and the host that gave it. A refused message has no upstream result, and neither has a row logged before 2.10.0.

Accepted mail is recorded as it passes; refused mail is read from mail.log, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.

Filter lists

Two lists for the whole server that correct the spam filter by hand. An entry is a sender address, a sender domain — that domain, not its subdomains — or a client address or network in CIDR form. A sender on the Deny list is refused outright. A sender on the Allow list is given a weight no spam score outweighs, so the filter lets it through. The sender's address is whatever the sending server says it is - anyone can claim to be a sender you allow - so allow a client address or network where you can, and a sender address only for mail you would rather receive forged than lose. When entries of both lists match one message, Deny wins.

SelfPost does not apply the lists itself: it writes them as files under /data/antispam/, and rspamd rereads a file within seconds of a change. With the spam filter off the lists are kept and can be edited, but nothing reads them. The sender matched is the envelope sender — the one in the log — not the From line a mail program shows. Matched counts the messages in the Inbound log that the entry decided, so it reaches back as far as the log does; never means not once in that time, and such an entry is one to consider removing.