Notify sender is not working in blacklist rules

[dhinilkv]

Just now i sent a mail to bin-drai domain from a blocked email manesh@saturnme.com, please find the below log and give a solution to rectify the issue ASAP.
Jul 13 10:30:53 proxmox postfix/smtpd[2339559]: connect from mail-ot1-f43.google.com[209.85.210.43]
Jul 13 10:30:54 proxmox postfix/smtpd[2339559]: 88368101259: client=mail-ot1-f43.google.com[209.85.210.43]
Jul 13 10:30:54 proxmox postfix/cleanup[2339529]: 88368101259: message-id=<CAGpFaXUMQGg33x9YTovs=-VEg+QUo3TrYv8__76fTMKKMjso0g@mail.gmail.com>
Jul 13 10:30:54 proxmox postfix/qmgr[2334457]: 88368101259: from=<manesh@saturnme.com>, size=3550, nrcpt=1 (queue active)
Jul 13 10:30:54 proxmox pmg-smtp-filter[2339490]: 1012B564AF9A1E94420: new mail message-id=<CAGpFaXUMQGg33x9YTovs=-VEg+QUo3TrYv8__76fTMKKMjso0g@mail.gmail.com>#012
Jul 13 10:30:54 proxmox postfix/smtpd[2339559]: disconnect from mail-ot1-f43.google.com[209.85.210.43] ehlo=1 mail=1 rcpt=1 bdat=1 quit=1 commands=5
Jul 13 10:30:56 proxmox pmg-smtp-filter[2339490]: 1012B564AF9A1E94420: SA score=0/5 time=1.380 bayes=0.49 autolearn=ham autolearn_force=no hits=AWL(-0.995),BAYES_50(0.8),DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DKIM_VALID_AU(-0.1),DKIM_VALID_EF(-0.1),HTML_MESSAGE(0.001),RCVD_IN_DNSWL_NONE(-0.0001),RCVD_IN_MSPIKE_H3(0.001),RCVD_IN_MSPIKE_WL(0.001),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),T_SCC_BODY_TEXT_LINE(-0.01)
Jul 13 10:30:56 proxmox pmg-smtp-filter[2339490]: 1012B564AF9A1E94420: notify <manesh@saturnme.com> (rule: Blacklist, 20D181012CD)
Jul 13 10:30:56 proxmox pmg-smtp-filter[2339490]: 1012B564AF9A1E94420: block mail to <bvy@bin-drai.com> (rule: Blacklist)
Jul 13 10:30:56 proxmox pmg-smtp-filter[2339490]: 1012B564AF9A1E94420: processing time: 1.575 seconds (1.38, 0.085, 0)
Jul 13 10:30:56 proxmox postfix/lmtp[2339530]: 88368101259: to=<bvy@bin-drai.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.9, delays=0.25/0/0.05/1.6, dsn=2.7.0, status=sent (250 2.7.0 BLOCKED (1012B564AF9A1E94420))
Jul 13 10:30:56 proxmox postfix/qmgr[2334457]: 88368101259: removed

 

[Stoiko Ivanov]

Don't see what the issue is - you sent a mail from a blocked email and it was ... blocked:

Jul 13 10:30:56 proxmox pmg-smtp-filter[2339490]: 1012B564AF9A1E94420: block mail to <bvy@bin-drai.com> (rule: Blacklist)

 

[dhinilkv]

but i enabled notification for blocked sender from proxmox. but the sender not received any notification mail.

 

[Stoiko Ivanov]

but i enabled notification for blocked sender from proxmox. but the sender not received any notification mail.

ul 13 10:30:56 proxmox pmg-smtp-filter[2339490]: 1012B564AF9A1E94420: notify <manesh@saturnme.com> (rule: Blacklist, 20D181012CD)

This line tells you that the rulesystem sent a notification - check your logs (search for 20D181012CD) to see what happened with the notification mail...

 

[dhinilkv]

Ok. Is there any particular command to search for 20D181012CD? I'm using Zimbra on a linux machine.

 

[Stoiko Ivanov]

just search the logs of your PMG - the files in /var/log ... - e.g. /var/log/syslog, or the system journal...

 

[dhinilkv]

Jul 18 10:43:41 proxmox postfix/lmtp[24492]: CC71E1013A8: to=<admin@bin-drai.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.2, delays=0.39/0/0.04/1.8, dsn=2.7.0, status=sent (250 2.7.0 BLOCKED (1013A964B6349BD8C6D))
Jul 18 10:43:41 proxmox postfix/qmgr[18915]: CC71E1013A8: removed
Jul 18 10:43:42 proxmox postfix/postscreen[24654]: PASS NEW [52.100.196.203]:5749
Jul 18 10:43:42 proxmox postfix/smtpd[24657]: connect from mail-au2are01hn2203.outbound.protection.outlook.com[52.100.196.203]
Jul 18 10:43:43 proxmox pmgpolicy[23749]: SPF says pass
Jul 18 10:43:43 proxmox postfix/smtpd[24657]: 01A981012C9: client=mail-au2are01hn2203.outbound.protection.outlook.com[52.100.196.203]
Jul 18 10:43:43 proxmox postfix/cleanup[24213]: 01A981012C9: message-id=<323dfa0788e043399ee2b628fd5e308b@DXZP273MB0493.AREP273.PROD.OUTLOOK.COM>
Jul 18 10:43:43 proxmox postfix/qmgr[18915]: 01A981012C9: from=<>, size=10656, nrcpt=1 (queue active)
Jul 18 10:43:43 proxmox pmg-smtp-filter[24694]: 2023/07/18-10:43:43 CONNECT TCP Peer: "[127.0.0.1]:49448" Local: "[127.0.0.1]:10024"
Jul 18 10:43:43 proxmox postfix/smtpd[24657]: disconnect from mail-au2are01hn2203.outbound.protection.outlook.com[52.100.196.203] ehlo=1 mail=1 rcpt=1 bdat=1 quit=1 commands=5
Jul 18 10:43:43 proxmox pmg-smtp-filter[24694]: 1013A864B6349F12877: new mail message-id=<323dfa0788e043399ee2b628fd5e308b@DXZP273MB0493.AREP273.PROD.OUTLOOK.COM>
Jul 18 10:43:43 proxmox postfix/smtp[24651]: 94DD0101196: to=<manesh@saturnme.com>, relay=aspmx.l.google.com[142.250.27.27]:25, delay=1.5, delays=0.05/0/0.73/0.71, dsn=5.7.26, status=bounced (host aspmx.l.google.com[142.250.27.27] said: 550-5.7.26 Unauthenticated email from bin-drai.com is not accepted due to 550-5.7.26 domain's DMARC policy. Please contact the administrator of 550-5.7.26 bin-drai.com domain if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. a23-20020a17090682d700b00988a0d75324si733492ejy.279 - gsmtp (in reply to end of DATA command))
Jul 18 10:43:43 proxmox postfix/cleanup[24402]: 1D08B1013AA: message-id=<20230718064343.1D08B1013AA@proxmox.bin-drai.com>
Jul 18 10:43:43 proxmox postfix/qmgr[18915]: 1D08B1013AA: from=<>, size=4700, nrcpt=1 (queue active)
Jul 18 10:43:43 proxmox postfix/bounce[24707]: 94DD0101196: sender non-delivery notification: 1D08B1013AA
Jul 18 10:43:43 proxmox postfix/qmgr[18915]: 94DD0101196: removed
Jul 18 10:43:43 proxmox postfix/cleanup[24213]: 22376101196: message-id=<20230718064343.1D08B1013AA@proxmox.bin-drai.com>
Jul 18 10:43:43 proxmox postfix/qmgr[18915]: 22376101196: from=<>, size=4848, nrcpt=1 (queue active)
Jul 18 10:43:43 proxmox postfix/local[24708]: 1D08B1013AA: to=<postmaster@proxmox.bin-drai.com>, relay=local, delay=0.03, delays=0/0.02/0/0.01, dsn=2.0.0, status=sent (forwarded as 22376101196)
Jul 18 10:43:43 proxmox postfix/qmgr[18915]: 1D08B1013AA: removed
Jul 18 10:43:43 proxmox pmg-smtp-filter[24694]: WARNING: ^* matches null string many times in regex; marked by <-- HERE in m/^* <-- HERE .icommarketing.com$/ at /usr/share/perl5/PMG/RuleDB/WhoRegex.pm line 103.
Jul 18 10:43:43 proxmox pmg-smtp-filter[24694]: WARNING: ^* matches null string many times in regex; marked by <-- HERE in m/^* <-- HERE .eu.mailgun.net$/ at /usr/share/perl5/PMG/RuleDB/WhoRegex.pm line 103.
Jul 18 10:43:43 proxmox postfix/smtp[24650]: 22376101196: to=<dhinil@bin-drai.com>, orig_to=<postmaster@proxmox.bin-drai.com>, relay=192.168.2.1[192.168.2.1]:25, delay=0.08, delays=0/0/0.01/0.07, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 34A4E6E00160)
Jul 18 10:43:43 proxmox postfix/qmgr[18915]: 22376101196: removed
Jul 18 10:43:43 proxmox pmg-smtp-filter[24694]: WARNING: Unrecognized escape \m passed through in regex; marked by <-- HERE in m/^.*@.*smtp\m <-- HERE ydialoginsight\.com$$/ at /usr/share/perl5/PMG/RuleDB/WhoRegex.pm line 103.
Jul 18 10:43:43 proxmox pmg-smtp-filter[24694]: WARNING: Unrecognized escape \m passed through in regex; marked by <-- HERE in m/^.*o13.ptr6032.\m <-- HERE ail\.beehiiv\.com$$/ at /usr/share/perl5/PMG/RuleDB/WhoRegex.pm line 103.