Help prevent mailbomb DOS style attack


Well-Known Member
Jan 2, 2004
I am having issues with what I call a mailbomb. My server will just suddently start getting hundreds of messages a minute to the point that all the system can do is try to process the mail influx. I have the domain set to fail messages bound for an address that does not exist. What I end up with is hundreds of processes running at once and the majority are exim processes and mailnull processes. Below are two examples in the mail que. I have not been able to establish how to stop this from happening. It will come in every few weeks for 15-20 min and then stop.

It looks to me like these are messages that is being sent out with a fake address at one of the domains on my server as the from but the messages I do not belive are acutally origionating on my system. They seem to always have the same from address but I suspect if I put a rule in exim to do some kind of processing of that from address it will change. At the same time the influx is so fast and so much that the system cant process the messages quick enough with out causing the system to overload.

mailnull 47 12
1167144222 0
-received_protocol esmtp
-body_linecount 390

213P Received: from [] (
by with esmtp (Exim 4.63)
id 1GzDWo-0006Nn-2P
for oelschbjla@; Tue, 26 Dec 2006 09:43:43 -0500
105P Received: by (Postfix)
id E94B8BF86C; Tue, 26 Dec 2006 09:50:38 -0500 (EST)
044 Date: Tue, 26 Dec 2006 09:50:38 -0500 (EST)
071F From: [email protected] (Mail Delivery System)
045 Subject: Undelivered Mail Returned to Sender
035T To: oelschbjla@
018 MIME-Version: 1.0
123 Content-Type: multipart/report; report-type=delivery-status;
068I Message-Id: <[email protected]>

This is a MIME-encapsulated message.

Content-Description: Notification
Content-Type: text/plain

This is the Postfix program at host

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The Postfix program

<[email protected]>: host[] said: 550 No such
recipient (in reply to RCPT TO command)

Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns;
X-Postfix-Queue-ID: F1948BF87E
X-Postfix-Sender: rfc822; oelschbjla@
Arrival-Date: Tue, 26 Dec 2006 09:50:31 -0500 (EST)

Final-Recipient: rfc822; [email protected]
Action: failed
Status: 5.0.0
Diagnostic-Code: X-Postfix; host[] said: 550 No such
recipient (in reply to RCPT TO command)

Content-Description: Undelivered Message
Content-Type: message/rfc822

Received: from localhost (localhost [])
by (Postfix) with ESMTP id F1948BF87E
for <bru[email protected]>; Tue, 26 Dec 2006 09:50:31 -0500 (EST)
Received: from ([])
by localhost (host.domain.tld []) (amavisd-new, port 10024)
with ESMTP id 24728-07 for <[email protected]>;
Tue, 26 Dec 2006 09:50:16 -0500 (EST)
Received: from ( [])
by (Postfix) with ESMTP id 7C191BF847
for <bru[email protected]>; Tue, 26 Dec 2006 09:50:13 -0500 (EST)
Message-ID: <[email protected]>
From: "Lynelle Hayes" <oelschbjla@>
To: "Stephenie" <[email protected]>
Subject: Re: Sure think it is time
Date: Tue, 26 Dec 2006 15:43:05 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=1.983 tagged_above=-999 required=4 tests=BAYES_50,
X-Spam-Level: *

This is a multi-part message in MIME format.

Content-Type: multipart/alternative;

Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

----- Original Message -----
From: =
[email protected]
To: oelschbjla@
Sent: Friday, November 17, 2006 8:68 PM
Subject: Sure think it is time

Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.3790.0" name=3DGENERATOR>
<BODY bgColor=3D#ffffff>
<DIV> </DIV>
<p><IMG alt=3D"" hspace=3D0 src=3D"cid:GnYuSUtKVxHpPonb0mIQ" =
align=3Dbaseline border=3D0></p>
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style=3D"FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV style=3D"BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: =
<A title=3D=
[email protected]
[email protected]=
[email protected]=
</A> </DIV>
<DIV style=3D"FONT: 10pt arial"><B>To:</B> <A =
oelschbjla@</A> </DIV>
<DIV style=3D"FONT: 10pt arial"><B>Sent:</B> Friday, November 17, 2006 =
8:68 PM</DIV>
<DIV style=3D"FONT: 10pt arial"><B>Subject:</B> Sure think it is =



Content-Type: image/gif;
Content-Transfer-Encoding: base64
Content-ID: <GnYuSUtKVxHpPonb0mIQ>




Well-Known Member
May 29, 2004
Minneapolis, MN
I am having issues with what I call a mailbomb. My server will just suddently start getting hundreds of messages a minute to the point that all the system can do is try to process the mail influx.
What you are experiencing is a crafty way of knocking out any email server using a few carefully constructed emails. It is called Backscatter. Backscatter is a message you receive informing you that email you did not send was not delivered to someone you do not know. This type of of message is called a Delivery Status Notification or DSN. In most cases DSNs are welcome because the sender usually wants to know when a message can not be delivered to the recipient or that delivery of the message has been delayed for some reason. For more information about Backscatter, go to: