How to set Spamhaus DNSBL correctly?

[mgutt]

Regarding this website there is a special setting necessary to avoid false-positives because of the different response code "127.255.255.254" of Spamhaus:
https://www.heinlein-support.de/blog/news/achtung-neue-return-codes-bei-spamhaus

reject_rbl_client zen.spamhaus.org=127.0.0.[2..11]

Does it mean I need to add "zen.spamhaus.org=127.0.0.[2..11],b.barracudacentral.org"?

 

[hata_ph]

Just set your DNSBL list and threshold under Mail Proxy -> Options.

 

[mgutt]

This does not answer my question. This is only a workaround by raising all blacklist checks to two hits.

 

[hata_ph]

zen.spamhaus.org=127.0.0.[2..11]

If not mistaken, if you set as above, the dnsbl will only response/reject response code 127.0.0.2 to 127.0.0.11 and ignore others from spamhaus.org.

https://docs.iredmail.org/enable.dnsbl.html

 

[mgutt]

Which is correct as the other return codes are "not relevant":
https://www.spamhaus.org/faq/section/DNSBL Usage#200

127.255.255.254 Any Query via public/open resolver
127.255.255.255 Any Excessive number of queries

This means proxmox mgw blocks the mail, if we hit "excessive number of queries" or "query through public resolver" which happens as of my experience randomly.

We can solve this as follows:
- Not using spamhaus (they are the only one with this behaviour)
- Use your workaround which makes the filter weaker
- Let proxmox ignore the irrelevant return codes (which is my question how to set this up)

 

[hata_ph]

Which is correct as the other return codes are "not relevant":
https://www.spamhaus.org/faq/section/DNSBL Usage#200


This means proxmox mgw blocks the mail, if we hit "excessive number of queries" or "query through public resolver" which happens as of my experience randomly.

We can solve this as follows:
- Not using spamhaus (they are the only one with this behaviour)
- Use your workaround which makes the filter weaker
- Let proxmox ignore the irrelevant return codes (which is my question how to set this up)

Are your PMG using public DNS like google or cloudflare? It will cause those 2 error.
Set PMG to use a local resolver/DNS server will solve the problem.

 

[mgutt]

Set PMG to use a local resolver/DNS server will solve the problem.

Not possible. We are using 1.1.1.2 or 9.9.9.11 only (security guidelines).

 

[Stoiko Ivanov]

Not possible. We are using 1.1.1.2 or 9.9.9.11 only (security guidelines).

For E-mail I would agree with @hata_ph - you need a resolver of your own to get any decent spam-detection due to some very good dnsbls/uribls having a ratelimit

Alternatively you can consider getting a paid feed from them (these are usually quite well configurable with public resolvers as well)