Global Blocklist not working

T

the_MiCrO

New Member
Sep 9, 2025
13
8
3
Hi
I have a problem with our global Blocklist.
I added the domainpart and a regex and I still receive Mails from that domain (Massmailing all our Homepages)....

Global Blocklist
1782886277703.png

(enabled) Blocklist Rule
(Highest priority)
1782886366235.png

Mail Header
Delivered-To: event@ourdomain.com
Return-Path: sm.21177883674.m9f0c8k9bh6zheoe05-zaproszenie=warsawexpo.eu@emsgrid.com
Received-SPF: pass (emsgrid.com: Sender is authorized to use 'sm.#.m9f0c8k9bh6zheoe05-zaproszenie=warsawexpo.eu@emsgrid.com' in 'mfrom' identity (mechanism 'include:_spf.jupiter.salesmanago.pl' matched)) receiver=spam.ourdomain.com; identity=mailfrom; envelope-from="sm.#.m9f0c8k9bh6zheoe05-zaproszenie=warsawexpo.eu@emsgrid.com"; helo=izanagi.emlgrid.com; client-ip=185.54.187.89
Received: from izanagi.emlgrid.com (izanagi.emlgrid.com [185.54.187.89])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(No client certificate requested)
by spam.ourdomain.com (Proxmox) with ESMTPS
for <event@ourdomain.com>; Tue, 30 Jun 2026 16:38:58 +0200 (CEST)
Received: from s12 (_local_)
by emsgrid.com (mta01) with ESMTP id 4gqQhm1GrLzFC0DX
for <event@ourdomain.com>; Tue, 30 Jun 2026 14:37:12 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smgrid.eu;
s=sm-trackid; t=1782830232; x=1782875232;
bh=NX3yBSPsS7o/HjvRIHpQjACoTkqqJw6pPFrOOHG4G/k=;
h=Date:From:To:Subject:List-Unsubscribe:List-Unsubscribe-Post:Date:
From:To:Subject:List-Id:List-Unsubscribe:List-Unsubscribe-Post:CC;
b=BLBkBT2Vvxv118FcOlc714tojuh8bXRtpa0MFFyo+DPdQ4CgxmnYTLrRUB9En6XRs
WB921ynpBmBYXwPV6QrIJfyvGlgGeh/Lr9+9OTGe4NRhk6pC1KDbgPW5SEckaxZMbM
DG+Z4JzQlsmD+bb/G3pB7J/zd8ynThTJ3bk05XJleV3rl4w3i8JOj3fCJnoDRJkcvP
tInNoGaaQbknAESyTQrt/Cu4dbnxCf5CJWI7+naW0MH5R3gOh4+nn63bsDlDclGRJ0
2YZt3C85DB8fCd6PAlI11rUJU7QwIewynufgL4ngDTOq1aj00KGJ1Rt2+bPgpmQ89H
iQ+a5yu/RNf8w==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=warsawexpo.eu;
s=salesmanago; t=1782830232; x=1782875232;
bh=NX3yBSPsS7o/HjvRIHpQjACoTkqqJw6pPFrOOHG4G/k=;
h=Date:From:To:Subject:List-Unsubscribe:List-Unsubscribe-Post:Date:
From:To:Subject:List-Id:List-Unsubscribe:List-Unsubscribe-Post:CC;
b=sVm2cQqdBVMgudVRunPB3jm/ZIphwrzPqfjRctVdPLbc2ZL9MExzBcZDEuB7zcIm9
+mx6WFAGMDE0K2bApTq4yNXSvV2zSqJ2mf3suAF7We4PVQspkZOT4G/IZLBxQYZEI2
0xnB1uvDS5wQ+ByQf/vagxKmUyy+fhSwYeZJs6gpn8GbP42mxiyJX6D/WrixLLj5Qx
zKq6ms+c/m2prgNkORbxAkO/VDHE2mHFvSRyM3638FdjFhxYBvZDOGY7JFAJH34txD
O5ostIlfFA0iQGwwZAf8ID10BdV7S80ZMjMDtnFdpa8+X/jgdnUj8cmEBER/3tVL+C
0bgIsmKwruHog==
Date: Tue, 30 Jun 2026 16:37:12 +0200 (CEST)
From: Ptak Warsaw Expo <zaproszenie@warsawexpo.eu>
To: event@ourdomain.com
Message-Id: <21177883674.30232104@emsgrid.com21177883674>
subject: {Spam?} Kalendarz targowy - =?UTF-8?Q?jesie=C5=84=20?=2026
X-Abuse: Please report abuse here: abuse@salesmanago.pl
X-Campaign: 1f55a9cc-b7e6-4a14-a882-1612c45f12fd
Feedback-ID: 1f55a9cc-b7e6-4a14-a882-1612c45f12fd:m9f0c8k9bh6zheoe:m9f0c8k9bh6zheoe:SALESmanago
List-Unsubscribe: <mailto:unsubscribe+GYCcYtqoEB8FdECmt1X-XASh9Vqcy35qFIghYSxF8S_Q5@emsgrid.com?subject=GYCcYtqoEB8FdECmt1X-XASh9Vqcy35qFIghYSxF8S_Q5>,
<https://app3.salesmanago.pl/optOut....b7e6-4a14-a882-1612c45f12fd&optOutLanguage=pl>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Precedence: bulk
X-Entity-Ref-ID: none
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_3525844_777915629.1782830232104"
X-SPAM-LEVEL: Spam detection results: 5
CustomCheck 0.8 Custom Check Script
DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid
DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature
DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain
DMARC_PASS -0.1 DMARC pass policy
GB_GEN_REDIR_URL 0.5 Redirector found in href link
HEADER_FROM_DIFFERENT_DOMAINS 0.249 From and EnvelopeFrom 2nd level mail domains are different
HTML_MESSAGE 0.001 HTML included in message
KAM_EU 0.5 Prevalent use of .eu in spam/malware
KAM_SHORT 0.001 Use of a URL Shortener for very short URL
MIME_HTML_MOSTLY 0.1 Multipart message mostly text/html MIME
MIXED_ES 0.001 Too many es are not es
MPART_ALT_DIFF 0.3 HTML and text parts are different
RCVD_IN_MSPIKE_H5 0.001 Excellent reputation (+5)
RCVD_IN_MSPIKE_WL 0.001 Mailspike good senders
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
T_TVD_FUZZY_SECTOR 0.01 -
UNPARSEABLE_RELAY 0.001 Informational: message has unparseable relay lines
UNWANTED_LANGUAGE_BODY 2.8 Message written in an undesired language
Click to expand...
 
proxmox-mailgateway-container: 9.1 (API: 9.1.0/0b3beca05f9e, running kernel: 7.0.12-1-pve)
pmg-api: 9.1.0
pmg-gui: 5.2.1
clamav-daemon: 1.4.4+dfsg-1~deb13u1+pmg1
ifupdown: residual config
ifupdown2: 3.3.0-1+pmx12
libarchive-perl: 3.7.4.1
libjs-extjs: 7.0.0-5
libproxmox-acme-perl: 1.7.1
libproxmox-acme-plugins: 1.7.1
libpve-apiclient-perl: 3.4.2
libpve-common-perl: 9.1.16
libpve-http-server-perl: 6.0.5
libxdgmime-perl: 1.2.0
lvm2: not correctly installed
pmg-docs: 9.1.1
pmg-i18n: 3.8.0
pmg-log-tracker: 3.1.2
pmg-mobile-quarantine-ui: 0.5.3
proxmox-mini-journalreader: 1.6
proxmox-offline-mirror-helper: 0.7.4
proxmox-spamassassin: 4.0.2-2
proxmox-widget-toolkit: 5.2.5
pve-xtermjs: 6.0.0-1
Click to expand...


Tracking
2026-06-30T16:38:58.406543+02:00 spam postfix/smtpd[293078]: connect from izanagi.emlgrid.com[185.54.187.89]
2026-06-30T16:38:58.517850+02:00 spam postfix/smtpd[293078]: Anonymous TLS connection established from izanagi.emlgrid.com[185.54.187.89]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
2026-06-30T16:38:58.575427+02:00 spam postfix/smtpd[293078]: NOQUEUE: client=izanagi.emlgrid.com[185.54.187.89]
2026-06-30T16:38:58.791067+02:00 spam pmg-smtp-filter[293145]: A164A6A43D502BEE17: new mail message-id=<21177883674.30232104@emsgrid.com21177883674>
2026-06-30T16:38:58.791233+02:00 spam pmg-smtp-filter[293145]: A164A6A43D502BEE17: mail-headers envelope-from=<sm.21177883674.m9f0c8k9bh6zheoe05-zaproszenie=warsawexpo.eu@emsgrid.com> envelope-to=<event@ourdomain.com> from="Ptak Warsaw Expo <zaproszenie@warsawexpo.eu> " to="event@ourdomain.com " subject="Kalendarz targowy - jesień 2026 "
2026-06-30T16:39:00.194925+02:00 spam pmg-smtp-filter[293145]: A164A6A43D502BEE17: SA score=5/5 time=1.128 bayes=undefined autolearn=disabled hits=CustomCheck(0.8),DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DKIM_VALID_AU(-0.1),DMARC_PASS(-0.1),GB_GEN_REDIR_URL(0.5),HEADER_FROM_DIFFERENT_DOMAINS(0.249),HTML_MESSAGE(0.001),KAM_EU(0.5),KAM_SHORT(0.001),MIME_HTML_MOSTLY(0.1),MIXED_ES(0.001),MPART_ALT_DIFF(0.3),RCVD_IN_MSPIKE_H5(0.001),RCVD_IN_MSPIKE_WL(0.001),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),T_TVD_FUZZY_SECTOR(0.01),UNPARSEABLE_RELAY(0.001),UNWANTED_LANGUAGE_BODY(2.8)
2026-06-30T16:39:00.197432+02:00 spam pmg-smtp-filter[293145]: A164A6A43D502BEE17: modified header 'X-SPAM-LEVEL' for <event@ourdomain.com> (rule: Modify Header)
2026-06-30T16:39:00.197748+02:00 spam pmg-smtp-filter[293145]: A164A6A43D502BEE17: modified header 'subject' for <event@ourdomain.com> (rule: Quarantine/Mark Spam (Level 5))
2026-06-30T16:39:00.204915+02:00 spam pmg-smtp-filter[293145]: A164A6A43D502BEE17: moved mail for <event@ourdomain.com> to spam quarantine - A16FC6A43D5043057D (rule: Quarantine/Mark Spam (Level 5))
2026-06-30T16:39:00.206877+02:00 spam pmg-smtp-filter[293145]: A164A6A43D502BEE17: processing time: 1.42 seconds (1.128, 0.06, 0.212)
2026-06-30T16:39:00.207211+02:00 spam postfix/smtpd[293078]: proxy-accept: END-OF-MESSAGE: 250 2.5.0 OK (A164A6A43D502BEE17); from=<sm.21177883674.m9f0c8k9bh6zheoe05-zaproszenie=warsawexpo.eu@emsgrid.com> to=<event@ourdomain.com> proto=ESMTP helo=<izanagi.emlgrid.com>
2026-06-30T16:39:00.207638+02:00 spam postfix/smtpd[293078]: disconnect from izanagi.emlgrid.com[185.54.187.89] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
Click to expand...


Tracking for a newer Mail (not even marked as spam)
2026-07-01T09:43:53.515401+02:00 spam postfix/smtpd[306595]: connect from izanagi.emlgrid.com[185.54.187.89]
2026-07-01T09:43:53.630933+02:00 spam postfix/smtpd[306595]: Anonymous TLS connection established from izanagi.emlgrid.com[185.54.187.89]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
2026-07-01T09:43:53.880437+02:00 spam postfix/smtpd[306595]: NOQUEUE: client=izanagi.emlgrid.com[185.54.187.89]
2026-07-01T09:43:53.982258+02:00 spam pmg-smtp-filter[305435]: A180A6A44C539EEBCC: new mail message-id=<21182448069.91830291@emsgrid.com21182448069>
2026-07-01T09:43:53.982410+02:00 spam pmg-smtp-filter[305435]: A180A6A44C539EEBCC: mail-headers envelope-from=<sm.21182448069.m9f0c8k9bh6zheoe05-matuszewski.bartosz=warsawexpo.eu@emsgrid.com> envelope-to=<event@ourdomain.com> from="Bartosz Matuszewski <matuszewski.bartosz@warsawexpo.eu> " to="event@ourdomain.com " subject="Intergastra - Follow up "
2026-07-01T09:43:56.552193+02:00 spam pmg-smtp-filter[305435]: A180A6A44C539EEBCC: SA score=2/5 time=1.719 bayes=undefined autolearn=disabled hits=CustomCheck(0.9),AWL(0.365),DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DKIM_VALID_AU(-0.1),DMARC_PASS(-0.1),GB_GEN_REDIR_URL(0.5),HEADER_FROM_DIFFERENT_DOMAINS(0.249),HTML_MESSAGE(0.001),HTTPS_HTTP_MISMATCH(0.1),KAM_EU(0.5),MIME_HTML_MOSTLY(0.1),MPART_ALT_DIFF(0.3),RCVD_IN_MSPIKE_H5(0.001),RCVD_IN_MSPIKE_WL(0.001),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),UNPARSEABLE_RELAY(0.001)
2026-07-01T09:43:56.554209+02:00 spam pmg-smtp-filter[305435]: A180A6A44C539EEBCC: modified header 'X-SPAM-LEVEL' for <event@ourdomain.com> (rule: Modify Header)
2026-07-01T09:43:56.555077+02:00 spam postfix/smtpd[306828]: connect from localhost[127.0.0.1]
2026-07-01T09:43:56.555875+02:00 spam postfix/smtpd[306828]: 87B0EA1839: client=localhost[127.0.0.1], orig_client=izanagi.emlgrid.com[185.54.187.89]
2026-07-01T09:43:56.556433+02:00 spam postfix/cleanup[306829]: 87B0EA1839: message-id=<21182448069.91830291@emsgrid.com21182448069>
2026-07-01T09:43:56.599988+02:00 spam postfix/qmgr[459]: 87B0EA1839: from=<sm.21182448069.m9f0c8k9bh6zheoe05-matuszewski.bartosz=warsawexpo.eu@emsgrid.com>, size=21179, nrcpt=1 (queue active)
2026-07-01T09:43:56.600064+02:00 spam postfix/smtpd[306828]: disconnect from localhost[127.0.0.1] ehlo=1 xforward=1 mail=1 rcpt=1 data=1 commands=5
2026-07-01T09:43:56.600112+02:00 spam pmg-smtp-filter[305435]: A180A6A44C539EEBCC: accept mail to <event@ourdomain.com> (87B0EA1839) (rule: default-accept)
2026-07-01T09:43:56.601974+02:00 spam pmg-smtp-filter[305435]: A180A6A44C539EEBCC: processing time: 2.621 seconds (1.719, 0.039, 0.808)
2026-07-01T09:43:56.602228+02:00 spam postfix/smtpd[306595]: proxy-accept: END-OF-MESSAGE: 250 2.5.0 OK (A180A6A44C539EEBCC); from=<sm.21182448069.m9f0c8k9bh6zheoe05-matuszewski.bartosz=warsawexpo.eu@emsgrid.com> to=<event@ourdomain.com> proto=ESMTP helo=<izanagi.emlgrid.com>
2026-07-01T09:43:56.602548+02:00 spam postfix/smtpd[306595]: disconnect from izanagi.emlgrid.com[185.54.187.89] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
2026-07-01T09:43:56.608441+02:00 spam postfix/smtp[306830]: Untrusted TLS connection established to mail.ourdomain.local[192.168.5.98]:2525: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
2026-07-01T09:44:02.656318+02:00 spam postfix/smtp[306830]: 87B0EA1839: to=<event@ourdomain.com>, relay=mail.ourdomain.local[192.168.5.98]:2525, delay=6.1, delays=0.04/0/0.01/6, dsn=2.6.0, status=sent (250 2.6.0 <21182448069.91830291@emsgrid.com21182448069> [InternalId=155920197746780, Hostname=srvourdomain03-i.ourdomain.local] 22114 bytes in 6.036, 3,577 KB/sec Queued mail for delivery)
2026-07-01T09:44:02.656682+02:00 spam postfix/qmgr[459]: 87B0EA1839: removed
Click to expand...

And the pmgdb dump
RULE 4 (prio: 98, in, ACTIVE): Blocklist
FROM group 2 (and=0, invert=0): Blocklist
OBJECT Regular Expression 44: .*@warsawexpo.e.*
OBJECT Domain 47: warsawexpo.eu
ACTION group 18: Block
OBJECT Block 31: block message
RULE 3 (prio: 96, out, ACTIVE): Virus Alert
WHAT group 9 (and=0, invert=0): Virus
OBJECT Virus Filter 22: active
ACTION group 18: Block
OBJECT Block 31: block message
ACTION group 20: Notify Admin
OBJECT Notification 33: notify __ADMIN__
ACTION group 21: Notify Sender
OBJECT Notification 34: notify __SENDER__
RULE 2 (prio: 96, in, ACTIVE): Block Viruses
WHAT group 9 (and=0, invert=0): Virus
OBJECT Virus Filter 22: active
ACTION group 19: Quarantine
OBJECT Quarantine 32: Move to quarantine.
ACTION group 20: Notify Admin
OBJECT Notification 33: notify __ADMIN__
RULE 1 (prio: 93, in, ACTIVE): Block Dangerous Files
WHAT group 8 (and=0, invert=0): Dangerous Content
OBJECT ContentType Filter 17: content-type=application/javascript
OBJECT ContentType Filter 14: content-type=application/vnd\.microsoft\.portable-executable
OBJECT ContentType Filter 18: content-type=application/x-executable
OBJECT ContentType Filter 16: content-type=application/x-java
OBJECT ContentType Filter 15: content-type=application/x-msdownload
OBJECT ContentType Filter 19: content-type=message/partial
OBJECT Match Filename 20: filename=.*\.(vbs|pif|lnk|shs|shb)
OBJECT Match Filename 21: filename=.*\.\{.+\}
ACTION group 15: Remove attachments
OBJECT Remove attachments 28: remove matching attachments
RULE 5 (prio: 90, in, ACTIVE): Modify Header
ACTION group 13: Modify Spam Level
OBJECT Header Attribute 26: modify field: X-SPAM-LEVEL:__SPAM_INFO__
RULE 13 (prio: 89, in, inactive): Quarantine Office Files
WHAT group 7 (and=0, invert=0): Office Files
OBJECT ContentType Filter 9: content-type=application/msword
OBJECT ContentType Filter 7: content-type=application/vnd\.ms-excel
OBJECT ContentType Filter 8: content-type=application/vnd\.ms-powerpoint
OBJECT ContentType Filter 11: content-type=application/vnd\.oasis\.opendocument\..*
OBJECT ContentType Filter 10: content-type=application/vnd\.openxmlformats-officedocument\..*
OBJECT ContentType Filter 12: content-type=application/vnd\.stardivision\..*
OBJECT ContentType Filter 13: content-type=application/vnd\.sun\.xml\..*
ACTION group 23: Attachment Quarantine (remove matching)
OBJECT Remove attachments 36: remove matching attachments
RULE 12 (prio: 87, in+out, inactive): Block Multimedia Files
WHAT group 6 (and=0, invert=0): Multimedia
OBJECT ContentType Filter 5: content-type=audio/.*
OBJECT ContentType Filter 6: content-type=video/.*
ACTION group 15: Remove attachments
OBJECT Remove attachments 28: remove matching attachments
RULE 6 (prio: 85, in, ACTIVE): Welcomelist
FROM group 3 (and=0, invert=0): Welcomelist
OBJECT Regular Expression 43: .*@.*.mail.anthropic.com
OBJECT Regular Expression 48: .*@about-drinks.com
OBJECT Mail address 2: mail@fromthisdomain.example
OBJECT Mail address 46: redaktion@about-drinks.com
OBJECT Domain 42: origin.mail.become1.de
OBJECT IP Address 41: 112.5.89.73
OBJECT IP Address 40: 2a01:4f9:6a:21d4::2
OBJECT IP Address 39: 65.21.235.43
ACTION group 17: Accept
OBJECT Accept 30: accept message
RULE 9 (prio: 82, in, ACTIVE): Block Spam (Level 10)
WHAT group 12 (and=0, invert=0): Spam (Level 10)
OBJECT Spam Filter 25: Level 10
ACTION group 18: Block
OBJECT Block 31: block message
RULE 8 (prio: 81, in, ACTIVE): Quarantine/Mark Spam (Level 5)
WHAT group 11 (and=0, invert=0): Spam (Level 5)
OBJECT Spam Filter 24: Level 5
ACTION group 19: Quarantine
OBJECT Quarantine 32: Move to quarantine.
ACTION group 14: Modify Spam Subject
OBJECT Header Attribute 27: modify field: subject:{Spam?} __SUBJECT__
RULE 7 (prio: 80, in, ACTIVE): Mark Spam (Level 3)
WHAT group 10 (and=0, invert=0): Spam (Level 3)
OBJECT Spam Filter 23: Level 3
ACTION group 14: Modify Spam Subject
OBJECT Header Attribute 27: modify field: subject:{Spam?} __SUBJECT__
RULE 10 (prio: 70, out, inactive): Block outgoing Spam
WHAT group 10 (and=0, invert=0): Spam (Level 3)
OBJECT Spam Filter 23: Level 3
ACTION group 18: Block
OBJECT Block 31: block message
ACTION group 20: Notify Admin
OBJECT Notification 33: notify __ADMIN__
ACTION group 21: Notify Sender
OBJECT Notification 34: notify __SENDER__
RULE 11 (prio: 60, out, inactive): Add Disclaimer
ACTION group 22: Disclaimer
OBJECT Disclaimer 35: disclaimer
Click to expand...


By the way: Personal blocklists work as expected :-/
 
Your blocklist object lists:
* '.*@warsawexpo.e.*` as regex
* warsawaexpo.eu as domain

the mail's envelope sender is: 'sm.21177883674.m9f0c8k9bh6zheoe05-zaproszenie=warsawexpo.eu@emsgrid.com'
and does not match your object (there is no @ before warsawaexpo.e - so the regex does not match, the mail comes from domain emsgrid.com)

either be a bit wider and change the regex to '.*warsawaexpo\.e.*' or add emsgrid.com as domain.

I hope this helps
 
  • Like
Reactions: Onslow, the_MiCrO and j.theisen
  • Like
Reactions: the_MiCrO
You must log in or register to reply here.
Top Bottom
Back