/etc/postfix/main.cf

alias_maps = hash:/etc/aliases
virtual_alias_maps = hash:/etc/aliases
smtpd_banner = mailalm.example.com JSC "NAT Kazakhstan"
# Disable unix notifications
biff = no
delay_warning_time = 12h
strict_rfc821_envelopes = yes
smtpd_helo_required = yes

smtpd_recipient_restrictions =
    reject_unauth_pipelining
    reject_non_fqdn_sender
    reject_non_fqdn_recipient
    reject_non_fqdn_helo_hostname
    reject_invalid_helo_hostname
    reject_unauth_destination
    reject_multi_recipient_bounce
    check_helo_access hash:/etc/postfix/checks/helo_checks
    check_helo_access pcre:/etc/postfix/checks/helo_checks.pcre
    check_sender_access hash:/etc/postfix/checks/sender_checks
    check_recipient_access hash:/etc/postfix/checks/recipient_checks
    # reject_unknown_helo_hostname
    reject_unknown_client_hostname
    check_client_access pcre:/etc/postfix/checks/client_check.pcre
    reject_unknown_sender_domain
    reject_unknown_address
    check_policy_service unix:private/spf
    reject_unlisted_recipient
    # check_client_access hash:/etc/postfix/checks/client_check
    reject_rbl_client pbl.spamhaus.org
    reject_rbl_client zen.spamhaus.org
    reject_rbl_client sbl.spamhaus.org
    reject_rbl_client xbl.spamhaus.org
    reject_rbl_client cbl.abuseat.org
    reject_rbl_client bl.spamcop.net
    reject_rbl_client dnsbl.sorbs.net
    reject_rhsbl_client rhsbl.sorbs.net
    check_policy_service inet:127.0.0.1:60000

myorigin = example.com
myhostname = mailalm.example.com
mydestination =
mynetworks =

virtual_mailbox_domains = example.com
virtual_mailbox_maps = proxy:ldap:ldapmap
virtual_transport = hash:/etc/postfix/virtual_transport
transport_maps = hash:/etc/postfix/virtual_transport

ldapmap_version = 3
ldapmap_domain = example.com
ldapmap_bind_dn = postfix@example.com
ldapmap_bind_pw = MegoPassword
ldapmap_search_base = dc=example, dc=com
ldapmap_server_host =     dc05.example.com, dc06.example.com
ldapmap_server_port = 3268
ldapmap_query_filter = (&(proxyAddresses=smtp:%s)(|(&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))(objectClass=group)))
ldapmap_result_filter = %s
ldapmap_result_attribute = mail
-------------------------------------------------------------------------------

/etc/postfix/master.cf

# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
spamf     unix  -       n       n       -       -       pipe
    user=spam argv=/home/spam/spamfilter.sh -f $(sender) -- $(recipient)
smtp       inet    n    -    -    -    -    smtpd
    -o content_filter=spamf
smtp      unix  -       -       -       -       -       smtp
spf      unix  -       n       n       -       -    spawn
    user=nobody argv=/usr/bin/policyd-spf
pickup    fifo  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       -       proxymap
relay     unix  -       -       -       -       -       smtp
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
retry     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
virtual   unix  -       n       n       -       -       virtual
anvil     unix  -       -       -       -       1       anvil
--------------------------------------------------------------------------

/etc/postfix/checks/client_check

мои доверненные домены          OK Trust to this domen
..

--------------------------------------------------------------------------
/etc/postfix/checks/client_check.pcre

/(modem|dia(l|lup)|dialin|dsl|p[cp]p|cable|catv|poo(l|les)|dhcp|client|customer|user|[0-9]{6,})(-|\.|[0-9])/    REJECT spamer hostname
/(\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3})/ REJECT numeric hostname

--------------------------------------------------------------------------
/etc/postfix/checks/helo_checks

example.com            REJECT You are not me 1
mail.example.com    REJECT You are not me 2
mailalm.example.com    REJECT You are not me 3
localhost            REJECT You are not localhost 4
myip                REJECT You are not me 5
secondmyip           REJECT You are not me 6
..

--------------------------------------------------------------------------
/etc/postfix/checks/helo_checks.pcre

/\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/    REJECT I don't like dynamic addressess

--------------------------------------------------------------------------
/etc/postfix/checks/sender_checks

example.com            REJECT you are not @example.com .!.
subscribe.ru        REJECT mail from subscribe.ru deny
humo.ru                REJECT mail from humo.ru deny
wapstat.ru            REJECT mail from wapstat.ru deny
odnoklassniki.ru    REJECT mail from odnoklassniki.ru deny
amazon.com          REJECT mail from amazon.com deny
undp.org            REJECT mail from undp.org deny
vkontakte.ru        REJECT mail from vkontakte.ru deny
imhonet.ru            REJECT mail from imhonet.ru deny
mirtesen.ru            REJECT mail from mirtesen.ru deny
corp.mail.ru        REJECT mail from corp.mail.ru deny
khodorkovsky.ru     REJECT mail from khodorkovsky.ru deny              
monamour.ru         REJECT mail from monamour.ru deny
cnews.ru            REJECT mail from cnews.ru deny
pirivet.msk.ru        REJECT mail from pirivet.msk.ru deny
rin.ru                REJECT mail from rin.ru deny
mail.kz                REJECT mail from mail.kz deny
supercom.kz            REJECT mail from supercom.kz deny
rbc.ru                REJECT mail from rbc.ru deny
intourservice.kz    REJECT mail from intourservice.kz deny
ozon.ru                REJECT mail from ozon.ru deny
ashleyllc.com        REJECT mail from ashleyllc.com deny
yahoo.com            REJECT mail from yahoo.com deny
knc.kz                REJECT mail from knc.kz deny
ak-cent.kz            REJECT mail from ak-cent.kz deny
proxad.net          REJECT mail from proxad.net deny
facebookmail.com    REJECT mail from facebookmail.com deny
euratechnews.de        REJECT mail from euratechnews.de deny

--------------------------------------------------------------------------
/home/spam/spamfilter.sh

#!/bin/sh
INSPECT_DIR=/home/spam/mail
SENDMAIL="/usr/sbin/sendmail -i"
SPAMASSASSIN=/usr/bin/spamc
EX_TEMPFAIL=75
EX_UNAVAILABLE=69
cd $INSPECT_DIR || { echo $INSPECT_DIR does not exist; exit
$EX_TEMPFAIL; }
# Clean up when done or when aborting.
trap "rm -f in.$$; rm -f out.$$" 0 1 2 3 15
cat | $SPAMASSASSIN > out.$$ || { echo Message content rejected; exit
$EX_UNAVAILABLE; }
$SENDMAIL "$@" < out.$$
exit $?

--------------------------------------------------------------------------
/etc/spamassassin/local.cf

rewrite_header Subject *****SPAM*****
use_bayes 1
bayes_auto_learn 1
lock_method flock
bayes_min_spam_num 50
bayes_min_ham_num 50
bayes_ignore_header X-Spam-Flag
bayes_ignore_header X-Spam-Status

required_score 6
score HTTP_USERNAME_USED 7
score FAKE_HELO 7
score FORGED_RCVD 7
score UNWANTED_LANGUAGE_BODY 7
score MLM 5
score RCVD_NUMERIC_HELO 4
score MISSING_SUBJECT 3
score SPF_PASS -5
score RDNS_DYNAMIC 8
score MSGID_OUTLOOK_INVALID 5

body VIAGRA /viagra/i
body PENIS /penis/i
score VIAGRA 8
score PENIS 8
score DEAR_WINNER 8

ok_locales ru en

--------------------------------------------------------------------------
/etc/postgrey/whitelist_clients

# postgrey whitelist for mail client hostnames
# --------------------------------------------
# put this file in /etc/postgrey or specify its path
# with --whitelist-clients=xxx

# Debian-specific additions
# I *know* they run real mail queues, so greylisting only creates
# bigger load for them.

gmail.com
google.com
mail.ru
bk.ru
list.ru
rambler.ru
yandex.ru
yandex.net

--------------------------------------------------------------------------
/etc/postgrey/whitelist_recipients

# postgrey whitelist for mail recipients
# --------------------------------------
# put this file in /etc/postgrey or specify its path
# with --whitelist-recipients=xxx

postmaster@
abuse@