Block Spam on Self-Hosted iRedMail: Step-by-Step

This guide walks you through the most effective ways to reduce spam on your self-hosted iRedMail server. You’ll learn how to enable and tune built-in spam filters, set up greylisting, and configure fail2ban to block repeat offenders. By the end, you’ll have a multi-layered defense that stops the vast majority of junk mail before it reaches your inbox.

What You’ll Need

• Root or sudo access to your iRedMail server (SSH)
• Basic familiarity with the command line and editing files with nano or vim
• iRedMail already installed and running (version 1.x or 2.x, any current release)
• An email client or webmail access to test changes

Step-by-Step

1. Log in to your server via SSH. Use your preferred terminal: ssh user@your-server-ip. Switch to root if needed: sudo su -.
2. Update your system and iRedMail packages. Run apt update && apt upgrade (Debian/Ubuntu) or yum update (CentOS/RHEL). This ensures you have the latest spam rule definitions and security patches.
3. Enable SpamAssassin. iRedMail installs SpamAssassin but it may not be fully active by default. Edit the main configuration: nano /etc/mail/spamassassin/local.cf. Set required_hits 5.0 (a reasonable starting threshold) and uncomment or add rewrite_header Subject [SPAM]. Save and exit.
4. Restart Amavis (or the mail filter service). The service name varies: systemctl restart amavis or systemctl restart clamav-milter (if you use ClamAV). Check with systemctl status amavis to confirm it’s running.
5. Enable greylisting. iRedMail includes Postgrey. Activate it by editing /etc/postfix/main.cf. Add or uncomment the line: smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023. Then restart Postfix: systemctl restart postfix.
6. Configure fail2ban for aggressive blocking. iRedMail ships with jail configurations. Edit /etc/fail2ban/jail.local (create if missing). Add or adjust the [postfix] and [dovecot] sections to set enabled = true, maxretry = 3, bantime = 3600. Restart fail2ban: systemctl restart fail2ban.
7. Set up SPF, DKIM, and DMARC records. While not strictly spam blocking, these help your server authenticate legitimate mail and reduce the chance your own emails get flagged. iRedMail has a script: cd /opt/www/iredadmin/tools && python generate_spf_dkim_dmarc.py. Follow the printed instructions to add the DNS TXT records to your domain.
8. Test your spam filtering. Send a test email from an external account (like Gmail) to your iRedMail address. Check the headers: look for X-Spam-Score and X-Spam-Status. If the score is above your threshold, the subject will be prefixed with [SPAM].
9. Adjust the threshold if needed. If you get too many false positives, raise required_hits to 6 or 7. If spam still slips through, lower it to 4. Restart Amavis after each change.
10. Add a custom blacklist. For persistent spam domains, edit /etc/postfix/blacklist (create if needed) and add lines like spamdomain.com REJECT. Then add to /etc/postfix/main.cf: smtpd_recipient_restrictions = ... check_sender_access hash:/etc/postfix/blacklist. Run postmap /etc/postfix/blacklist and restart Postfix.

Common Mistakes

• Forgetting to restart services. Changes to SpamAssassin or Postfix won’t take effect until you restart the corresponding service. Always restart after editing config files.
• Setting the spam threshold too low. A threshold of 3.0 or lower will likely flag legitimate newsletters and personal emails. Start with 5.0 and adjust based on real traffic.
• Not checking DNS records. SPF/DKIM/DMARC are not just for outgoing mail; they also help remote servers trust your domain. If they’re missing, your emails may be marked as spam by others, and some spam filters may treat your server as suspicious.
• Ignoring the mail logs. The logs at /var/log/mail.log (or /var/log/maillog) are your best diagnostic tool. If spam is getting through, check the scores and reasons there.
• Using a public IP that’s blacklisted. If your server’s IP is on a DNSBL, even the best filters won’t help. Check with dig -x your-ip or use online tools to see if you’re listed.

Tips

• Use Bayesian filtering. SpamAssassin can learn from your ham/spam. Train it by moving emails to the Junk folder and then running sa-learn --spam /path/to/junk and sa-learn --ham /path/to/inbox periodically.
• Enable ClamAV virus scanning. It’s installed by default but make sure it’s active in Amavis. Edit /etc/amavis/conf.d/15-content_filter_mode and set @bypass_virus_checks_maps = (1); to 0 to enable.
• Set up a quarantine folder. Instead of deleting spam, have Amavis move it to a quarantine. In /etc/amavis/conf.d/50-user, add $final_spam_destiny = D_DISCARD; (or D_BOUNCE) and $virus_quarantine_method = "local:spam/%b"; to keep a copy for review.
• Monitor fail2ban regularly. Use fail2ban-client status postfix to see banned IPs. If you see your own IP banned, you can unban with fail2ban-client set postfix unbanip IP.
• Keep your rules updated. SpamAssassin rules are updated via sa-update. Set up a cron job to run sa-update daily and restart Amavis afterward.

Troubleshooting

Spam still getting through? First, check the mail headers for the spam score. If the score is low (below your threshold), the email might be using obfuscation techniques. Consider raising the threshold but also enable more tests in SpamAssassin. If the score is high but the email still arrives, check that Amavis is actually processing it—look for “spam� in the mail log.

Legitimate emails marked as spam? Lower your threshold or whitelist trusted senders. Add their addresses to /etc/mail/spamassassin/local.cf with whitelist_from user@example.com. Also check that your SPF/DKIM records are correct; failures can increase spam scores.

Greylisting causing delays? Some legitimate servers retry after a few minutes, but others may not. If you notice delays, you can whitelist specific domains or IPs in Postgrey’s whitelist file (/etc/postgrey/whitelist_clients).

fail2ban not banning? Check the jail log /var/log/fail2ban.log. Make sure the filter files are correct for your Postfix version. Sometimes the log path is different; adjust logpath in the jail configuration.

Services won’t restart? Run systemctl status on the failing service to see the error. Often it’s a syntax error in a config file. Use postfix check to validate Postfix config, and spamassassin -D --lint to test SpamAssassin rules.

Emails from your own domain are being blocked? This usually means your SPF or DKIM is misconfigured. Use online tools to verify your DNS records. Also ensure that your server’s hostname matches your domain’s MX record.

Frequently Asked Questions

Will these steps block all spam?

No method is 100% effective, but combining SpamAssassin, greylisting, and fail2ban will stop the vast majority (often 95-99%) of spam. Some sophisticated spam may still slip through, so periodic review of your logs is recommended.

Can I use a third-party spam filter instead?

Yes, you can replace or supplement iRedMail’s built-in tools with services like SpamAssassin (already included) or commercial filters like SpamHero or MailScanner. However, the built-in tools are free and effective when properly configured.

How often should I update SpamAssassin rules?

Daily updates are ideal. Spam patterns change quickly, so running sa-update via cron once a day keeps your rules current without overloading the server.

Will greylisting affect legitimate email?

Most legitimate mail servers retry after a temporary failure, so it usually causes only a few minutes of delay. However, some small or misconfigured servers may not retry, so you might miss emails from them. You can whitelist those specific senders.

Do I need to configure SPF/DKIM/DMARC for spam filtering?

Not strictly for inbound filtering, but they help your outgoing mail avoid being marked as spam by other servers. They also improve your domain’s reputation, which indirectly reduces the chance that your server is blacklisted.

What if I want to completely block a country’s IP range?

You can add IP ranges to Postfix’s smtpd_client_restrictions using check_client_access with a hash file. However, this is a blunt tool and may block legitimate contacts. Use it sparingly and only for known spam sources.

Related

• Uber Steps: Did They Improve Experience?
• Home vs Community Battery: Costs, Access & Benefits
• Fish It NPC Quests: Complete Guide