add Global blacklist => 163.com (not work)

N

nec_k

New Member
Feb 25, 2026
10
1
3
I’m having trouble with spam originating from China. The sender’s address is random@163.com.

I added the 163.com domain to the blacklist, but, to my surprise, blocking a domain that begins with numbers doesn’t work the same way as blocking domains made up of letters.

The emails bypass the blocking rule and continue to land in users’ inboxes.

Any suggestions on how to deal with this? Blocking the IP addresses associated with 163.com isn’t an option either, since they change constantly.11111111.png222.png
 
Last edited:
Hi @nec_k

thanks for posting on the forum!

I just tested a sender domain with just numbers and your regex pattern and it successfully blocked the mail on my system.
What version of PMG are you currently running?
Can you share a (redacted) version of a complete trace for one of the spam e-mails?

In my case the blocklist looks like:
1789395652291.png
and the trace:
Code: 
2026-09-14T14:16:25.198174+00:00 pmg-so postfix/smtpd[622]: connect from unknown[10.23.0.254]
2026-09-14T14:16:25.204116+00:00 pmg-so postfix/smtpd[622]: 31CFA838F: client=unknown[10.23.0.254]
2026-09-14T14:16:25.204379+00:00 pmg-so postfix/cleanup[709]: 31CFA838F: message-id=<20260914161625.344312@HOST>
2026-09-14T14:16:25.207299+00:00 pmg-so postfix/qmgr[426]: 31CFA838F: from=<test@123.com>, size=634, nrcpt=1 (queue active)
2026-09-14T14:16:25.207322+00:00 pmg-so postfix/smtpd[622]: disconnect from unknown[10.23.0.254] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
2026-09-14T14:16:25.257494+00:00 pmg-so pmg-smtp-filter[461]: 81ED6AA801B93E71E: new mail message-id=<20260914161625.344312@HOST>
2026-09-14T14:16:25.540621+00:00 pmg-so pmg-smtp-filter[461]: 81ED6AA801B93E71E: SA score=0/5 time=0.270 bayes=undefined autolearn=disabled hits=ALL_TRUSTED(-1),DKIM_ADSP_NXDOMAIN(0.8),FREEMAIL_FROM(0.001),KAM_DMARC_STATUS(0.01),KAM_LAZY_DOMAIN_SECURITY(1),SPF_NONE(0.001)
2026-09-14T14:16:25.541347+00:00 pmg-so pmg-smtp-filter[461]: 81ED6AA801B93E71E: block mail to <RECEIVER> (rule: Blocklist)
2026-09-14T14:16:25.550834+00:00 pmg-so pmg-smtp-filter[461]: 81ED6AA801B93E71E: processing time: 0.285 seconds (0.27, 0.011, 0)
2026-09-14T14:16:25.551156+00:00 pmg-so postfix/lmtp[710]: 31CFA838F: to=<RECEIVER>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.35, delays=0.01/0/0.05/0.3, dsn=2.7.0, status=sent (250 2.7.0 BLOCKED (81ED6AA801B93E71E))
2026-09-14T14:16:25.551411+00:00 pmg-so postfix/qmgr[426]: 31CFA838F: removed

Best regards
Jonas
 
I just checked the settings and added my external email address to the block list.

The email wasn't blocked either. =( So, the "Block" / blacklist filter isn't working.
It’s not a domain name issue.



You can check log (I changed the domain name).


Code: 
2026-09-14T09:50:13.786128+03:00 srv-mg1 postfix/smtpd[1898162]: connect from m16.mail.163.com[117.135.210.2]
2026-09-14T09:50:15.662401+03:00 srv-mg1 postfix/smtpd[1898162]: A18F08458D: client=m16.mail.163.com[117.135.210.2]
2026-09-14T09:50:16.088287+03:00 srv-mg1 postfix/cleanup[1899789]: A18F08458D: message-id=<3e9b11f2.9ac4.1a09eae0711.Coremail.13410454013@163.com>
2026-09-14T09:50:16.517134+03:00 srv-mg1 postfix/qmgr[1400761]: A18F08458D: from=<13410454013@163.com>, size=64030, nrcpt=1 (queue active)
2026-09-14T09:50:16.580661+03:00 srv-mg1 pmg-smtp-filter[1899950]: 845946AA799288904F: new mail message-id=<3e9b11f2.9ac4.1a09eae0711.Coremail.13410454013@163.com>
2026-09-14T09:50:16.729338+03:00 srv-mg1 postfix/smtpd[1898162]: disconnect from m16.mail.163.com[117.135.210.2] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
2026-09-14T09:50:19.286342+03:00 srv-mg1 pmg-smtp-filter[1899950]: 845946AA799288904F: SA score=0/5 time=2.585 bayes=undefined autolearn=disabled hits=DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DKIM_VALID_AU(-0.1),DKIM_VALID_EF(-0.1),DMARC_PASS(-0.1),FREEMAIL_ENVFROM_END_DIGIT(1),FREEMAIL_FROM(0.001),FROM_LOCAL_DIGITS(0.001),HTML_FONT_SIZE_LARGE(0.001),HTML_MESSAGE(0.001),LOTS_OF_MONEY(0.001),RCVD_IN_MSPIKE_H3(-0.01),RCVD_IN_MSPIKE_WL(-0.01),SPF_HELO_NONE(0.001),SPF_PASS(-0.001)
2026-09-14T09:50:19.292440+03:00 srv-mg1 pmg-smtp-filter[1899950]: 845946AA799288904F: modified header 'X-SPAM-LEVEL' for <sales@example.ru> (rule: Modify Header)
2026-09-14T09:50:19.293689+03:00 srv-mg1 pmg-smtp-filter[1899950]: 845946AA799288904F: added disclaimer (rule: Add Disclaimer EU-TXT)
2026-09-14T09:50:19.299937+03:00 srv-mg1 postfix/smtpd[1899144]: connect from localhost.localdomain[127.0.0.1]
2026-09-14T09:50:19.301824+03:00 srv-mg1 postfix/smtpd[1899144]: 499CC845A3: client=localhost.localdomain[127.0.0.1], orig_client=m16.mail.163.com[117.135.210.2]
2026-09-14T09:50:19.306279+03:00 srv-mg1 postfix/cleanup[1899810]: 499CC845A3: message-id=<3e9b11f2.9ac4.1a09eae0711.Coremail.13410454013@163.com>
2026-09-14T09:50:19.350464+03:00 srv-mg1 postfix/qmgr[1400761]: 499CC845A3: from=<13410454013@163.com>, size=68013, nrcpt=1 (queue active)
2026-09-14T09:50:19.350587+03:00 srv-mg1 postfix/smtpd[1899144]: disconnect from localhost.localdomain[127.0.0.1] ehlo=1 xforward=1 mail=1 rcpt=1 data=1 commands=5
2026-09-14T09:50:19.350676+03:00 srv-mg1 pmg-smtp-filter[1899950]: 845946AA799288904F: accept mail to <sales@example.ru> (499CC845A3) (rule: default-accept)
2026-09-14T09:50:19.354244+03:00 srv-mg1 pmg-smtp-filter[1899950]: 845946AA799288904F: processing time: 2.788 seconds (2.585, 0.112, 0)
2026-09-14T09:50:19.354743+03:00 srv-mg1 postfix/lmtp[1897023]: A18F08458D: to=<sales@example.ru>, relay=127.0.0.1[127.0.0.1]:10024, delay=5.1, delays=2.3/0/0.04/2.8, dsn=2.5.0, status=sent (250 2.5.0 OK (845946AA799288904F))
2026-09-14T09:50:19.354857+03:00 srv-mg1 postfix/qmgr[1400761]: A18F08458D: removed
2026-09-14T09:50:19.633604+03:00 srv-mg1 postfix/smtp[1899437]: 499CC845A3: to=<sales@example.ru>, relay=10.141.52.30[10.141.52.30]:25, delay=0.33, delays=0.05/0/0/0.28, dsn=2.6.0, status=sent (250 2.6.0 <3e9b11f2.9ac4.1a09eae0711.Coremail.13410454013@163.com> [InternalId=159871567660464, Hostname=srv-exchange.example.msk] 68816 bytes in 0.109, 613.798 KB/sec Queued mail for delivery)
2026-09-14T09:50:19.633819+03:00 srv-mg1 postfix/qmgr[1400761]: 499CC845A3: removed[ATTACH type="full" size="1631x578"]99925[/ATTACH]
 

Attachments

  • Screenshot 2026-09-14 175014.png
    Screenshot 2026-09-14 175014.png
    83.1 KB · Views: 1
Last edited:
I just checked the settings and added my external email address to the block list.

The email wasn't blocked either. =( So, the "Block" / blacklist filter isn't working.
It’s not a domain name issue.
 
That's unexpected.

Does the trace indicate anything if there is another rule which applies before the blocklist?

Can you please execute the command pmgdb dump and look for the blocklist rule, which should look similar to this one but in your case with more objects
Code: 
RULE 4 (prio: 98, in, ACTIVE): Blocklist
  FROM group 2 (and=0, invert=0): Blocklist
    OBJECT Regular Expression 42: ^[a-zA-Z0-9_.+-]+@123\.com$
    OBJECT Mail address 1: nomail@fromthisdomain.example
    OBJECT Domain 41: 123.com
  ACTION group 18: Block
    OBJECT Block 31: block message

Best regards
Jonas
 
Code: 
> pmgdb dump
RULE 4 (prio: 98, in, ACTIVE): Blacklist
  FROM group 2 (and=0, invert=0): Blacklist
    OBJECT Regular Expression 1051: ^[a-zA-Z0-9_.+-]+@163\.com$
*****
    OBJECT Domain 1039: 163.com
****
  ACTION group 18: Block
    OBJECT Block 31: block message
 
Last edited:
Dear forum members, I happened to find the cause myself (or so I think :)).
It was set to "all match," but I had meant "any match"—I must have accidentally toggled the slider without noticing...

I'll put it to the test now. Thanks again...
An email sent to myself was successfully blocked. ("any match")
See the image:

Screenshot 2026-09-14 184148.png
 
You must log in or register to reply here.
Top Bottom
Back