final_virus_destiny D_REJECT

Mark Martinec Mark.Martinec+amavis at
Tue Apr 26 20:25:27 CEST 2016

Rob McKennon wrote:
>>> Hello,
>>> We are setting up Amavis and Clamav to detect credit cards coming 
>>> into
>>> our email, and it's working.  However, it's returning the original
>>> email to the sender, which also contains the credit card numbers.
>>> Receiving the credit card numbers is bad enough, sending them back 
>>> out
>>> again violates PCI. Is there a way to reject the email without
>>> returning the original email content?  Below is a returned email with
>>> test numbers as an example.
>>> Thank you,
>>> Rob McKennon
>>>                   The mail system
>>> <xxxxxxxxxx>: host[] said: 554 5.7.0 Reject,
>>> id=06026-19 - INFECTED: Heuristics.Structured.CreditCardNumber (in
>>> reply to end of DATA command)
>>> Final-Recipient: rfc822;xxxxxxxxxxxxx
>>> Original-Recipient: xxxxxxxxxxxxxx
>>> Action: failed
>>> Status: 5.7.0
>>> Remote-MTA: dns;
>>> Diagnostic-Code: smtp; 554 5.7.0 Reject, id=06026-19 - INFECTED:
>>> Heuristics.Structured.CreditCardNumber

This looks like a bounce message from an MTA (not from amavisd).

Preferably you should use a setup where amavisd is invoked
before-queue, so that a D_REJECT will affect the original
client session and no non-delivery notification will be sent.

Alternatively, with postfix you can limit the amount of a message
body that is included in a bounce generated by postfix:

  bounce_size_limit (default: 50000)

   The maximal amount of original message text that is sent in a
   non-delivery notification. Specify a byte count. A message is
   returned as either message/rfc822 (the complete original) or
   as text/rfc822-headers (the headers only). With Postfix version
   2.4 and earlier, a message is always returned as message/rfc822
   and is truncated when it exceeds the size limit.

A third option is to use D_BOUNCE as a destiny, so that
the bounce will be generated by amavisd and not by a MTA.
Such bounce will only include message header, no body of
the bounced message.

Of these three options, the only recommended one is to use
amavisd in a before-queue setup and reject unwanted messages
while they are being received.


More information about the amavis-users mailing list