Rejected emails by zen.spamhous.org

[Juraj M]

Hello. I have been observing strange behavior past a couple of days. Yesterday I had to bypass the PMG to get the emails delivered properly, but last night I turned it back on. It worked ok until around 8am when it randomly rejected a block of emails and then later on it started accepting emails. When it does reject the email it logs an error

Feb 15 08:19:51 pmg postfix/postscreen[370459]: NOQUEUE: reject: RCPT from [136.243.52.10]:38628: 550 5.7.1 Service unavailable; client [136.243.52.10] blocked using zen.spamhaus.org; from=<r.malekli@etjarat.com>, to=<peter.kuer@coxxxxxxnt.sk>, proto=ESMTP, helo=<nova4.euhosted.com>

I have tried turning off RBL with the same results. DNS is not reporting any errors. The only change that has happened in our network is that we are in the process of migrating exchange servers. So recently exchange 2019 has been implemented. The current server still functions.

Thank you for any pointers.
Juraj.

 

[Stoiko Ivanov]

Feb 15 08:19:51 pmg postfix/postscreen[370459]: NOQUEUE: reject: RCPT from [136.243.52.10]:38628: 550 5.7.1 Service unavailable; client [136.243.52.10] blocked using zen.spamhaus.org; from=<r.malekli@etjarat.com>, to=<peter.kuer@coxxxxxxnt.sk>, proto=ESMTP, helo=<nova4.euhosted.com>

That logline indicates that the IP 136.243.52.10 was reported as listed by zen.spamhaus.org, which you have configured as DNSBL - so either the IP was really listed at that time (it does not seem to be listed now) - or your DNS server has some kind of misconfiguration, which causes it to return a 127.x.x.x reply for the lookup to the dnsbl

I have tried turning off RBL with the same results.

where did you turn it off?

he only change that has happened in our network is that we are in the process of migrating exchange servers. So recently exchange 2019 has been implemented. The current server still functions.

Unless the exchange does some other services as well - a change in a downstream-mail-server should not have any effect on DNS resolution on your PMG.

I hope this helps!

 

[Juraj M]

Thank you for the quick reply. I suspect it may be my DNS. Can I use a public DNS instead? Or do you have any idea where I should look?

I turned off RBL in the PMG settings.

 

[Stoiko Ivanov]

Thank you for the quick reply. I suspect it may be my DNS.

Check out the getting started page on the PMG -wiki (with all linked pages)
there we have some instructions for setting up a DNS on PMG directly:
https://pmg.proxmox.com/wiki/index.php/Getting_started_with_Proxmox_Mail_Gateway

Can I use a public DNS instead?

technically yes - but many DNSBLs and URIBLs (which are very important to get good detection results) have a query limit, which is of course exhausted on the public DNS servers (which is why we wrote the instructions for a DNS-Server on PMG in the first place.

I hope this helps!