Postfix-based mail relay method and system
By introducing automated interception functions, domain name blacklist scoring mechanism and keyword checking and caching mechanism in the Postfix email relay system, the system's shortcomings in flexibility, security and logging are solved, and more efficient security checking and spam blocking effects are achieved.
Patent Information
- Application Number
- CN202411560504.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-04
- Publication Date
- 2025-03-25
AI Technical Summary
The existing Postfix mail relay system has shortcomings in flexibility, security and logging, and is unable to effectively respond to rapidly changing network environments and complex business needs, resulting in a lack of response capabilities in the face of malicious email attacks or abnormal traffic.
The Postfix-based email relay method is adopted, and dynamic security check and batch processing of emails is realized through automated interception functions, domain name blacklist scoring mechanisms and keyword checking and caching mechanisms, and the system's automated interception function and spam blocking efficiency are improved.
It improves the flexibility and practicality of security checking of the email relay system, enhances the efficiency and accuracy of interception of spam, improves the logging function, and provides deeper email traceability.
Smart Images
Figure CN119697149A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the technical field related to mail relay, and in particular, to a mail relay method and system based on Postfix. Background Art
[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.
[0003] At present, email systems widely rely on mail transfer agents (MTA) to send, receive and relay emails, and Postfix, as one of the open source mail transfer agent tools, has a wide range of applications. In the existing technical framework, Postfix's configuration and operation mostly use static rule configuration. This static forwarding method based on fixed routing rules works well in specific scenarios. However, with the increase in email traffic and security requirements, the limitations of this method in actual operation have gradually become apparent, especially in terms of flexibility, security and logging. There are several key issues:
[0004] 1) Insufficient flexibility: The existing Postfix system uses static rule configuration, and the rules for processing emails are relatively fixed, and it is impossible to dynamically adjust the email processing method based on the email content, source address, recipient, etc. This solution lacks a flexible processing mechanism and cannot cope with the rapidly changing network environment and complex business needs in actual operation. For example, when the email traffic suddenly surges or the sensitivity of the email content increases, the system cannot adaptively adjust the routing strategy and filtering rules, resulting in a lack of response capabilities when facing malicious email attacks or abnormal traffic.
[0005] 2) Lack of security: The filtering of sender blacklists and email content is not accurate and efficient enough, which may lead to the spread of unsafe or spam emails;
[0006] 3) Incomplete log records: Log records in the mail system are an important means to track mail activities, detect abnormal behaviors, and analyze system problems. However, the existing Postfix system is relatively simple in terms of log record function, and can often only record basic information such as the sending and receiving of mails, lacking a deeper mail traceability capability. For example, in complex business scenarios, when a certain mail fails to be sent or is delayed, it is difficult for administrators to quickly locate the cause of the problem through existing logs, and there is a lack of detailed diagnostic tools.
[0007] In summary, the current Postfix and other similar MTA mail relay systems are insufficient in terms of processing flexibility, security, and logging, especially in the face of increasing mail security risks and business complexity, and are unable to provide effective response measures. These deficiencies make the system vulnerable to attacks in actual applications, difficult to quickly adapt to dynamic needs, and limit the ability of operation and maintenance personnel to troubleshoot and optimize when problems occur. Summary of the invention
[0008] In order to solve the above problems, the present disclosure proposes a mail relay method and system based on Postfix, which can realize the automatic interception function and improve the flexibility and practicality of security inspection; through keyword inspection and caching mechanism, common spam mails are batch processed, which can improve the efficiency and accuracy of spam interception.
[0009] In order to achieve the above objectives, the present disclosure adopts the following technical solutions:
[0010] One or more embodiments provide a mail relay method based on Postfix, comprising the following steps:
[0011] Store received emails in the set hold directory;
[0012] When new mail is detected in the hold directory, the configuration information related to the mail sending channel is read and the mail content is stored in the specified storage directory;
[0013] Parse the email content of new emails stored in the specified directory to obtain key email information;
[0014] Based on the domain blacklist scoring and the keyword-based spam batch processing method, the key information of the parsed email is security checked, and the emails that pass the security check are pushed from the hold directory to the target mailbox, and the emails that fail the security check are returned.
[0015] One or more embodiments provide a Postfix-based mail relay system, including a mail sending terminal and a mail receiving terminal. A mail relay server is set between the mail sending terminal and the mail receiving terminal, and the mail relay server is configured to execute the above-mentioned Postfix-based mail relay method.
[0016] One or more embodiments provide a Postfix-based mail relay system, including:
[0017] The first storage module is configured to store received emails in a set hold directory;
[0018] The second storage module is configured to read the configuration information related to the mail sending channel and store the mail content in the designated storage directory when a new mail is detected in the hold directory;
[0019] Parsing module: configured to parse the email content of new emails stored in the specified directory to obtain key information of the emails;
[0020] Security check module: It is configured to score based on domain blacklists and check spam batch processing methods based on keywords. It performs security checks on the key information of parsed emails, pushes emails that pass the security check from the hold directory to the target mailbox, and returns emails that fail the security check.
[0021] An electronic device comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps in the above-mentioned mail relay method based on Postfix are completed.
[0022] A computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the steps in the above-mentioned Postfix-based mail relay method are completed.
[0023] Compared with the prior art, the present invention has the following beneficial effects:
[0024] In the present disclosure, by using a domain name blacklist and introducing a scoring mechanism, the domain name blacklist can be automatically updated to enhance the system's automated interception function and improve the flexibility and practicality of security checks; by using keyword checking and a caching mechanism, emails with similar content, especially those from different domain names but with the same content, can be identified; by introducing a caching mechanism to batch process common spam emails, the efficiency and accuracy of spam interception can be improved.
[0025] The advantages of the present disclosure and the advantages of additional aspects will be described in detail in the following specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS
[0026] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The exemplary embodiments of the present disclosure and the description thereof are used to explain the present disclosure but do not constitute a limitation of the present disclosure.
[0027] Figure 1 is a flow chart of the mail relay method of Embodiment 1 of the present disclosure;
[0028] Figure 2 is a flow chart of performing security check on mails in the mail relay method of Embodiment 1 of the present disclosure;
[0029] Figure 3is an example block diagram of a mail relay system according to Embodiment 2 of the present disclosure; DETAILED DESCRIPTION
[0030] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.
[0031] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.
[0032] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof. It should be noted that, in the absence of conflict, the various embodiments in the present disclosure and the features in the embodiments can be combined with each other. The embodiments will be described in detail below in conjunction with the accompanying drawings.
[0033] Example 1
[0034] In the technical solutions disclosed in one or more embodiments, Figures 1 to 3 As shown, a mail relay method based on Postfix includes the following steps:
[0035] Step 1: Store the received emails in the set hold directory and generate corresponding file names for the received emails;
[0036] Step 2: When a new email is detected in the hold directory, the configuration information related to the email sending channel is read and the email content is stored in the specified storage directory;
[0037] Step 3, parsing the email content of the new email stored in the specified directory to obtain the key information of the email;
[0038] Step 4: Based on the domain blacklist score and the keyword check spam batch processing method, a security check is performed on the parsed key information of the email, and the emails that pass the security check are pushed from the hold directory to the target mailbox, and the emails that fail the security check are returned.
[0039] In this embodiment, by using a domain name blacklist and introducing a scoring mechanism, the domain name blacklist can be automatically updated to enhance the system's automated interception function and improve the flexibility and practicality of security checks. By using keyword checking and a caching mechanism, emails with similar content, especially those from different domain names but with the same content, are identified. By introducing a caching mechanism to batch process common spam emails, the efficiency and accuracy of spam interception can be improved.
[0040] In step 1, a corresponding file name is generated for the emails stored in the set hold directory; the file name includes a timestamp, an email ID or a unique identifier of the email to ensure the uniqueness of each email file.
[0041] Install Postfix on the mail relay server and perform initial configuration of Postfix to implement the mail relay environment;
[0042] In step 1, configure the main configuration file main.cf of Postfix to set the header_checks rule and add the / ^Received: / hold rule;
[0043] After setting the header_checks rule in main.cf, Postfix will process the email according to the rule when it receives the email and parses its header information.
[0044] By adding the / ^Received: / hold rule, after the mail is transmitted from the sender to the Postfix server via the SMTP protocol, Postfix will put all received mails into the hold state at the initial stage according to this rule. In this state, the mails will not be delivered immediately, but will be stored in the specified / hold directory and wait for subsequent processing.
[0045] The processing method of step 1 above can provide a time window for security checks on received emails, thereby ensuring that only legitimate emails are delivered.
[0046] In step 2, the mail relay system is configured to read the main configuration file of Postfix at startup or periodically, and read the configuration information related to the received mail sending channel based on the main configuration file;
[0047] The mail relay system is developed based on Java. During mail processing, the system needs to read the Postfix configuration file to obtain relevant settings and parameters. The main configuration file of Postfix is usually located in / etc / postfix / main.cf. The system reads this configuration file at startup or periodically and loads relevant configurations into memory to reduce the overhead of frequent file reading during mail processing, thereby improving system performance.
[0048] Specifically, read the configuration information related to the mail sending channel, such as the mailbox's sending channel (transport) address, port, encryption method (such as SSL / TLS), authentication method, etc. Users can query, add, and modify these configurations through the mail relay system management page.
[0049] In step 2, the email content is stored in the specified storage directory, specifically:
[0050] The mail relay system implements the mail monitoring function by referencing the common-io package of Apache, which is used to monitor the newly added mail files in the hold directory. When a new file is detected in the hold directory, the system writes the mail content into the file with the .eml extension by calling a command, such as postcat-qpostid> / eml / postid.eml, and saves it in the specified mail storage directory;
[0051] The process of storing the email content in step 2 of this embodiment ensures that the email data will not be lost even if the server fails or restarts, and also provides a stable data source for subsequent email processing.
[0052] In step 3, in the email parsing process, the email file needs to be parsed first to obtain its key information;
[0053] Optionally, you can use the mail parsing library to read and parse the stored mail files to extract key information such as the sender, recipient, subject, and body of the mail; this information will be used for subsequent security checks, logging, and mail relay operations;
[0054] The mail parsing library may adopt the JavaMail mail parsing library.
[0055] After parsing the key information of the email, it is necessary to perform a security check to ensure the legitimacy and security of the email. In step 4, the preset blacklist is obtained, and the blacklist information is matched with the keyword information in a regular way, such as Figure 2 As shown, including:
[0056] Step 401: Obtain a preset blacklist;
[0057] Step 402: blacklist matching is performed, and regular expressions are used to check whether the recipient and sender addresses are in the blacklist preset by the mail relay system. If yes, the security check fails, otherwise, the next step of checking is performed;
[0058] Step 403, keyword scanning: matching the keywords extracted from the email content with the keywords in the blacklist, and checking whether there are set keywords in the blacklist in the email. If there are, the security check fails, otherwise, proceed to the next step of checking;
[0059] Specifically, the email content is scanned using a preset configured keyword list to match sensitive words in the email title and body;
[0060] Step 404: Based on the suspected keyword checking and caching mechanism, batch processing is performed on the suspected spam emails;
[0061] Suspected keyword check: cache detection results. If multiple emails (from different domain names) are found to be highly similar in title or body, these emails will be intercepted in batches and recorded.
[0062] Furthermore, the sender, recipient, processing result, email title and other information of the email are recorded to generate a log file for subsequent security analysis and tracing.
[0063] In step 401, specifically, the blacklist is preset in the following manner: the mail relay system provides a keyword, domain name, and suspected keyword management interface, allowing the administrator to add, delete, or modify keywords, domain names, and suspected keywords as needed to obtain a preset blacklist.
[0064] Furthermore, it also includes automatically updating a preset blacklist based on a domain name check and scoring mechanism, including the following steps:
[0065] Step 41: Obtain the domain name of the email sender and initialize the reputation score of each domain name;
[0066] Step 42: Setting weight coefficients for different operations on emails;
[0067] Among them, different operations are performed on the email, and the operation types may include: check interception, rejection, and successful delivery.
[0068] Step 43, counting the number of interception checks, rejections, and successful deliveries of emails sent through the domain name within a set period of time;
[0069] Step 44: Calculate the updated domain name reputation score based on the set weight coefficient and the type and number of email operations counted within the set time; loop through steps 43 to 44 until the domain name reputation score is less than the set value, and add the corresponding domain name to the preset blacklist to update the blacklist;
[0070] Specifically, in step 41, a dynamic domain name reputation scoring mechanism is designed for the domain name blacklist, and each domain name that sends an email can be set with an initial reputation score S0, which can be set to 100 points.
[0071] The reputation score of a domain name will be updated over time based on the type and amount of email operations corresponding to the domain name, and will be dynamically adjusted based on its behavior.
[0072] The update formula of domain reputation score S is:
[0073] S=S0-α*I(t)-β*R(t)+γ*L(t)
[0074] I(t) is the number of emails intercepted by the domain in time t;
[0075] R(t) represents the number of times the emails of the domain name were bounced within time t;
[0076] L(t) represents the number of legitimate emails that pass the security check for this domain name within time t;
[0077] α, β and γ are the weight coefficients of checking interception, rejection and successful sending respectively, which can be adjusted according to the actual situation of the system.
[0078] Blocked means that the message is blocked by security check, and bounced means that the message is bounced after being blocked by security check. Normal domain names can be bounced successfully, but many spam domain names are fake, so the bounce will fail. The messages that cannot be successfully bounced are classified as blocked; the messages that are successfully bounced after being blocked are classified as bounced.
[0079] Preferably, α and β can be set to positive values, representing deduction factors, and γ is set to a positive value to improve the score of a legitimate domain name. The specific settings can be as follows:
[0080] α=5: 5 points will be deducted for each interception;
[0081] β=3: 3 points will be deducted for each bounced email;
[0082] γ=1:Every time a legitimate email passes through, 1 point is added.
[0083] In this embodiment, the threshold can be set to 20 to 50. When the score of a domain name is lower than a specific threshold (such as 20 points), the system will automatically add the domain name to the blacklist and intercept all its emails.
[0084] Furthermore, in step 404, based on the suspected keyword checking and caching mechanism, the suspected spam emails are processed in batches, including the following steps:
[0085] Step 4-1: Scan the emails for security check and compare them with the spam keywords in the blacklist;
[0086] Specifically, the title and body of the email for security check are parsed to scan whether they contain predefined spam keywords;
[0087] Step 4-2: When a security check email is found to contain suspected keywords, cache the email;
[0088] The cache time can be set to several minutes, preferably 3 minutes; if the email contains suspected keywords of spam, the email will be cached for 3 minutes.
[0089] Step 4-3: During the set cache time, check whether there are other emails with different domain names that contain the same suspected keywords. If so, and the number of emails with the same suspected keywords exceeds the set threshold, all emails with the same suspected keywords will be rejected; otherwise, the emails will continue to the next security check.
[0090] Specifically, when the cache time is 3 minutes, monitor other emails in the next 3 minutes to check whether there are other emails from different domains containing the same keywords. If within 3 minutes, the system detects that the number of emails from different domains but containing the same content exceeds the set threshold (such as 10 emails), all these emails will be rejected and returned.
[0091] In this embodiment, in order to further identify spam, a suspected keyword check and cache mechanism is set. The core of this mechanism is to identify emails with similar content, which is used to identify emails with the same content from different domain names. If no similar suspicious emails are found within 3 minutes, the email will continue to pass further security checks. If the number of emails exceeds the threshold, these emails will be uniformly returned to prevent the large-scale spread of spam. This strategy can solve the common way of sending spam, sending similar email content through a large number of different domain names.
[0092] For mails that pass the security check, they are pushed from the relay server to the target mailbox. Specifically: the mail files in the hold directory are moved to the incoming directory of Postfix, and the system pushes the mails to the internal mailbox by executing the corresponding Postfix commands (such as postsuper-H postid and postqueue-f). During the push process, it is necessary to handle possible delivery failures or timeouts, and set timeouts and retries to ensure the reliability and stability of mail delivery.
[0093] During the entire processing process, the key information and processing results of each email are recorded, including the sender, recipient, inspection results, email title, etc., and can be viewed and analyzed through the management interface. Through log records, problems can be discovered in a timely manner, the causes can be located, and corresponding measures can be taken to ensure the security and stability of the email relay system.
[0094] The method of this embodiment realizes the automation and standardization of Postfix configuration, greatly improving the efficiency of system deployment. Compared with the traditional manual configuration method, it can ensure the consistency of configuration and reduce the possibility of human error, especially in large-scale and complex network environments, showing significant advantages; by integrating the Java-based email security inspection mechanism in the Postfix system, the efficiency of email parsing and inspection is improved, and spam and security threats can be discovered and blocked faster and more accurately. Compared with the traditional solution that relies on external tools, this embodiment provides more flexible security policy customization capabilities.
[0095] It also improves the monitorability and log analysis capabilities of the Postfix mail relay system. The system records the key information of each mail in detail, providing strong support for subsequent mail tracing and analysis.
[0096] Example 2
[0097] Based on Example 1, this embodiment provides a mail relay system based on Postfix, including a mail sending terminal and a mail receiving terminal, a mail relay server is set between the mail sending terminal and the mail receiving terminal, and the mail relay server is configured to execute the mail relay method based on Postfix described in Example 1;
[0098] Specifically, Figure 3 As shown, the mail sending terminal can send mails through the Internet mailbox, and the mail receiving terminal is an intranet device, and the mail receiving terminal receives mails through the intranet mailbox.
[0099] Example 3
[0100] Based on Example 1, this embodiment provides a mail relay system based on Postfix, including:
[0101] The first storage module is configured to store received emails in a set hold directory;
[0102] The second storage module is configured to read the configuration information related to the mail sending channel and store the mail content in the designated storage directory when a new mail is detected in the hold directory;
[0103] Parsing module: configured to parse the email content of new emails stored in the specified directory to obtain key information of the emails;
[0104] Security check module: It is configured to score based on domain blacklists and check spam batch processing methods based on keywords. It performs security checks on the key information of parsed emails, pushes emails that pass the security check from the hold directory to the target mailbox, and returns emails that fail the security check.
[0105] It should be noted here that the various modules in this embodiment correspond one-to-one to the various steps in Example 1, and the specific implementation process is the same, which will not be repeated here.
[0106] Example 4
[0107] Based on Example 1, this embodiment provides an electronic device, including a memory and a processor, and computer instructions stored in the memory and running on the processor. When the computer instructions are executed by the processor, the steps in the Postfix-based mail relay method described in Example 1 are completed.
[0108] Example 5
[0109] Based on Example 1, this embodiment provides a computer-readable storage medium for storing computer instructions. When the computer instructions are executed by a processor, the steps in the Postfix-based mail relay method described in Example 1 are completed.
[0110] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.
[0111] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.
Claims
1. A mail relay method based on Postfix, characterized in that: The steps include: Store received emails in the set hold directory; When new mail is detected in the hold directory, the configuration information related to the mail sending channel is read and the mail content is stored in the specified storage directory; Parse the email content of new emails stored in the specified directory to obtain key email information; Based on the domain blacklist scoring and keyword-based spam batch processing method, the key information of the parsed email is security checked, and the emails that pass the security check are pushed from the hold directory to the target mailbox, and the emails that fail the security check are returned.
2. The mail relay method based on Postfix as claimed in claim 1, characterized in that: The keyword checking spam batch processing method includes the following steps: Scan the emails to be checked for security and compare them with the spam keywords in the blacklist; When a security check email is found to contain suspicious keywords, the email will be cached; During the set cache time, check whether there are other emails with different domain names that contain the same suspected keywords. If there are, and the number of emails with the same suspected keywords exceeds the set threshold, all emails with the same suspected keywords will be bounced. Otherwise, the message continues to the security check.
3. The mail relay method based on Postfix as claimed in claim 1, characterized in that: Scoring based on domain name blacklists, that is, automatically updating the preset blacklist list based on domain name checking and scoring mechanism, includes the following steps: Step 41: Obtain the domain name of the email sender and initialize the reputation score of each domain name; Step 42: Setting weight coefficients for different operations on emails; Step 43, counting the number of interception checks, rejections, and successful deliveries of emails sent through the domain name within a set period of time; Step 44: Calculate the updated domain name reputation score based on the set weight coefficient and the type and number of email operations counted within a set time period; Steps 43 to 44 are executed repeatedly until the domain name reputation score is less than the set value, and the corresponding domain name is added to the preset blacklist list to implement the update of the blacklist.
4. The mail relay method based on Postfix as claimed in claim 3, characterized in that: The calculation formula of domain reputation score S is: S=S0-α*I(t)-β*R(t)+γ*L(t) Where: S0 is the initial credit score; I(t) is the number of emails blocked for a domain in time t; R(t) represents the number of times the emails of the domain name are bounced within time t; L(t) represents the number of emails that pass the security check for a domain name within time t; α, β, and γ are the weight coefficients of inspection interception, rejection, and successful delivery, respectively.
5. The mail relay method based on Postfix as claimed in claim 1, characterized in that: Perform security checks on the key information of the parsed email, including the following steps: Get the preset blacklist; Perform blacklist matching and use regular expressions to check whether the recipient and sender addresses are in the blacklist preset by the mail relay system. If so, the security check fails. Otherwise, proceed to the next step of checking. The keywords extracted from the email content are matched with the keywords in the blacklist to check whether there are set keywords in the blacklist in the email. If there are, the security check fails. Otherwise, the next step of checking is performed. Based on suspected keyword checking and caching mechanism, suspicious spam is processed in batches.
6. The mail relay method based on Postfix as claimed in claim 1, characterized in that: Record the sender, recipient, security check, email processing results, and email title information of the email, generate a log file and store it.
7. The mail relay system based on Postfix is characterized by: It comprises a mail sending terminal and a mail receiving terminal, wherein a mail relay server is arranged between the mail sending terminal and the mail receiving terminal, and the mail relay server is configured to execute the Postfix-based mail relay method according to any one of claims 1 to 6.
8. The mail relay system based on Postfix is characterized by: include: The first storage module is configured to store received emails in a set hold directory; The second storage module is configured to read the configuration information related to the mail sending channel and store the mail content in the designated storage directory when a new mail is detected in the hold directory; Parsing module: configured to parse the email content of new emails stored in the specified directory to obtain key information of the emails; Security check module: It is configured to score based on domain blacklists and check spam batch processing methods based on keywords. It performs security checks on the key information of parsed emails, pushes emails that pass the security check from the hold directory to the target mailbox, and returns emails that fail the security check.
9. An electronic device, characterized in that: The invention comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps of the mail relay method based on Postfix according to any one of claims 1 to 6 are completed.
10. A computer-readable storage medium, characterized in that: Used to store computer instructions, which, when executed by a processor, complete the steps of the Postfix-based mail relay method according to any one of claims 1 to 6.