DMARC rua unable to send reports via sendmail to local e-mail address?

This I have on top of the file:

smtp      inet  n       -       n       -       -       smtpd
  -o content_filter=spamassassin

smtps     inet  n       -       -       -       -       smtpd
  ...
  -o content_filter=spamassassin
  ...

Towards the bottom, there's this:

spamassassin  unix  -       n       n       -       -       pipe
  user=spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

I think this is your problem. According to this:

https://manpages.org/spamc

there is no -f option for spamc…

Frankly, I would take this stuff out let postfix just send the message to dovecot using LMTP. When the message is handed to dovecot, you can use a pigeonhole sieve script to do spam filtering as part of the delivery pipeline.

sieve is an internet-standard language for programming the delivery of mail. It's quite powerful…although it lacks some of the features you're used to in a "regular" programming language. pigeonhole is the name of the dovecot implementation of sieve.

The definitive documentation on sieve language features are the RFCs that define those features. None of them are terribly illustrative but, fortunately, sieve is a fairly straightforward language that is designed to be simple. Here's some learn-by-example info on the "flavor" of sieve programs:

https://support.tigertech.net/sieve

As you can see, you can get pretty creative on how you tell dovecot to deliver ham/spam.

I've been using sieve in limited ways to do simple stuff like this for a number of years.

Here's some info on how to set up pigeonhole sieve:

https://doc.dovecot.org/configuration_manual/sieve/configuration/

You'll need to install the dovecot-pigeonhole package (I think that's what it's called). Once installed, you'll need to configure the pigeonhole extension called vnd.dovecot.filter.

If you don't want to do this, use the spamassassin milter:

https://serverfault.com/questions/783401/how-to-get-spamassassin-working-with-postfix-as-a-milter

IMHO, either of these would be a much cleaner implementation than what you're trying to do here.

Hint: The milter will be less work to set up initially. The sieve approach will probably be (a lot!) more flexible in the long run. Perhaps you could do the milter initially while the sieve approach is in development…

-- sw

P.S. Once postfix hands the message off to dovecot, it's free receive another message. Involving spamassassin in the process of receiving messages can introduce a bottleneck into that process. As you probably are well-aware, spamassassin is written in perl and can't run as fast as postfix can potentially feed it. Although spamc/spamd speeds that process up a lot, spamassassin is going to be a lot slower (and resource intensive) than postfix. It's just the nature of the beast…

The permissions in /etc/postfix/main.cf are:

Emphasis is mine.

Is this a directory? Your description is unclear… If it is, you need to move all these files up one level to /etc/postfix.

-- sw

Is this a directory?

Oh, sorry no. main.cf is the file that is reported to be not openable in /var/log/mail.log.

/etc/postfix is where the files are located.

Can you post the part of /etc/postfix/master.cf where you pipe incoming mail to spamassassin?

I think that may be misconfigured.

-- sw

Sure.

This I have on top of the file:

smtp      inet  n       -       n       -       -       smtpd
  -o content_filter=spamassassin

smtps     inet  n       -       -       -       -       smtpd
  ...
  -o content_filter=spamassassin
  ...

Towards the bottom, there's this:

spamassassin  unix  -       n       n       -       -       pipe
  user=spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

Thanks for helping me again, @stevewi.

Hi @stevewi,

there is no -f option for spamc…

Ah, you're absolutely right. I configured SpamAssassin using instructions from this Linode Guide (cf. "Managing Spam With SpamAssassin") that should be wrong than.

Frankly, I would take this stuff out let postfix just send the message to dovecot using LMTP. When the message is handed to dovecot, you can use a pigeonhole sieve script to do spam filtering as part of the delivery pipeline.

For now I've disabled SpamAssassin and spamc. I'm going to monitor for a day, whether that solves my issue with sendmail or not.

IMHO, either of these would be a much cleaner implementation than what you're trying to do here.

On the weekend, I'll have some free time to investigate both alternatives.

Thank you very much for your long and detailed reply. It's very much appreciated!

-- Marc

Hi again @stevewi,

I've just taken a look at /var/log/mail.cf, after disabling SpamAssassin and spamc earlier today.
The old error involving sendmail is gone, but I've noticed a new one:

Feb 3 15:02:41 [hostname] postfix/qmgr[850]: 0C8711E038: from=noreply-dmarc-support@google.com, size=3558, nrcpt=1 (queue active)
Feb 3 15:02:41 [hostname] postfix/qmgr[850]: warning: connect to transport private/spamassassin: Connection refused
Feb 3 15:02:41 [hostname] postfix/error[1944]: 0C8711E038: to=<report@[domain].net>, relay=none, delay=354048, delays=354048/0.02/0/0.02, dsn=4.3.0, status=deferred (mail transport unavailable)</report@[domain].net>

Do you maybe know what the error here could be related to?

This might help you out:

https://stackoverflow.com/questions/26960730/postfix-mail-transport-unavailable-only-in-queue

My guess is that 0C8711E038 was queued before you disabled spamassassin.

-- sw

It worked! All your great suggestions solved my problems. Thank you very much, @stevewi. You're the best!!

You're welcome…

Just to followup on your Connection refused error… Another possibility is that spamd's socket was not located in /var/spool/postifix/private. postfix daemons can run chrooted. To achieve that, they expect everything they need to be in /var/spool/postfix. private is a subdirectory of that.

I really hope you try out sieve…I don't think you'll be disappointed.

-- sw