Frontline SMTP Defense: Configuring Postscreen and SpamAssassin on Linux VPS

Exposing port 25 to the public internet means your VPS will be constantly bombarded by distributed spam botnets, compromised IoT devices, and credential stuffing scanners. Each inbound connection that spawns a full Postfix smtpd daemon and invokes heavy SpamAssassin scanning filters consumes CPU cycles and RAM. Under heavy dictionary attacks, unshielded mail servers run out of process slots, causing legitimate mail delivery to delay or fail.

Postfix includes a frontline defense daemon called Postscreen. Postscreen sits in front of the Postfix smtpd processes, running lightweight non-blocking tests (pre-greeting delays, DNS blocklist scoring, and protocol pipelining tests) to drop 90 percent of spam connections before they consume server resources.

The genius of Postscreen lies in its understanding of spambot behavioral patterns. Standard RFC 5321 SMTP protocols mandate that the server speaks first, sending an initial 220 banner greeting. Only after the 220 greeting arrives is the client permitted to transmit EHLO or HELO. Spambots, designed to blast millions of payloads per hour, almost universally violate protocol by transmitting EHLO immediately after the TCP handshake completes without waiting for the server's banner. Postscreen pauses for 2 seconds before sending the banner; any client that speaks prematurely is flagged as a zombie bot and immediately disconnected.

Expand

Enabling Postscreen in master.cf

In /etc/postfix/master.cf, replace the standard smtp listener with postscreen, and move smtpd to internal pass-through sockets:

# /etc/postfix/master.cf
smtp      inet  n       -       y       -       1       postscreen
smtpd     pass  -       -       y       -       -       smtpd
dnsblog   unix  -       -       y       -       0       dnsblog
tlsproxy  unix  -       -       y       -       0       tlsproxy

The auxiliary daemon dnsblog queries DNS blocklists asynchronously without blocking Postscreen's event loop, while tlsproxy offloads STARTTLS handshakes.

Configuring Postscreen Pre-Greeting and DNSBL Scoring

In /etc/postfix/main.cf, configure multi-tiered anti-bot tests:

# /etc/postfix/main.cf
# Drop clients that speak before the SMTP 220 banner
postscreen_greet_action = drop
postscreen_greet_wait = 2s

# Multi-DNSBL scoring
postscreen_dnsbl_threshold = 3
postscreen_dnsbl_action = drop
postscreen_dnsbl_sites =
    zen.spamhaus.org*3
    b.barracudacentral.org*2
    bl.spameatingmonkey.net*1

# Pipeling test (detects fast-blasting spammers)
postscreen_pipelining_enable = yes
postscreen_pipelining_action = drop

# Non-SMTP command test
postscreen_non_smtp_command_enable = yes
postscreen_non_smtp_command_action = drop

# Cache verified legitimate sender IPs for 24 hours
postscreen_cache_cleanup_interval = 12h
postscreen_cache_retention_time = 7d

Notice the weighted DNSBL scoring system: listing on Spamhaus Zen provides an immediate score of 3, meeting the drop threshold. Lesser-known blocklists contribute partial scores, preventing a single false positive on an aggressive blocklist from rejecting legitimate business mail.

Layering SpamAssassin Content Scoring for Permitted Messages

For connections that pass Postscreen, SpamAssassin scans the email body and headers. Configure /etc/spamassassin/local.cf with aggressive Bayesian learning:

# /etc/spamassassin/local.cf
required_score 5.0
report_safe 0
rewrite_header Subject [SPAM]

# Bayesian filter
use_bayes 1
bayes_auto_learn 1
bayes_auto_learn_threshold_nonspam 0.1
bayes_auto_learn_threshold_spam 6.0

# Network checks
use_razor2 1
use_pyzor 1

Start and verify SpamAssassin:

sudo systemctl enable --now spamassassin
sudo spamassassin --lint

The Bayesian filter learns dynamically from your mail patterns. Legitimate transactional communications with scores below 0.1 train the non-spam model, while confirmed phishing attempts train the spam classifier.

Postscreen eliminates the vast majority of malicious traffic at the TCP handshake stage, keeping your server fast and responsive.

You can spin up an Ubuntu 24.04 instance on Netbay in under 60 seconds with Intel Xeon Platinum compute and high-speed SSD storage in Lucknow — netbayhosts.in.