[SOLVED] spamhaus not working on fresh install

[gck303]

I have installed a fresh 7.1-1 gateway and it is receiving emails and passing them to an iredmail email server.

DNSBL is configured as below. I have made very, very few other changes. It is a vanilla fresh install.



I have ran some tests from https://blt.spamhaus.com/. But, I get error messages!

    This email was delivered, but it should have been rejected during the SMTP session. Your MX is not configured to use SMTP-level block listing for the block list for this test.

How can I configure the SMTP level blocking?

 

[Stoiko Ivanov]

On a hunch - could you please restart `postfix` - `systemctl restart postfix` and report if this improves the situation?

 

[gck303]

Brilliant. I have managed to make some progress, but now it tells me the probe was rejected.

 

[Stoiko Ivanov]

Brilliant. I have managed to make some progress, but now it tells me the probe was rejected.

Thanks for the feedback - I need to look into restarting postfix in those cases...

as for the new issue - please post the logs of those tests

 

[gck303]

This is the details from the 'tracking centre'. Or, are there some backend longs that would be better?

Sep 15 10:22:22 pmg1 postfix/postscreen[19083]: NOQUEUE: reject: RCPT from [199.168.89.101]:39411: 550 5.7.1 Service unavailable; client [199.168.89.101] blocked using zen.spamhaus.org; from=<probe@unlisted.blt.spamhaus.net>, to=<gck@xxx.com>, proto=ESMTP, helo=<unlisted.blt.spamhaus.net>

 

[Stoiko Ivanov]

might be an issue with your DNS setup

what's the output of:

dig  101.89.168.199.zen.spamhaus.org

you probably need to install bind9-dnsutils for this - `apt install bind9-dnsutils`

 

[gck303]

Very strange. I can't ping zen.spamhaus.org...

root@pmg1:/etc/pmg# dig  101.89.168.199.zen.spamhaus.org

; <<>> DiG 9.16.27-Debian <<>> 101.89.168.199.zen.spamhaus.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10570
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;101.89.168.199.zen.spamhaus.org. IN    A

;; ANSWER SECTION:
101.89.168.199.zen.spamhaus.org. 429 IN A       127.255.255.254

;; Query time: 0 msec
;; SERVER: 192.168.0.22#53(192.168.0.22)
;; WHEN: Thu Sep 15 10:50:12 BST 2022
;; MSG SIZE  rcvd: 76

 

[Stoiko Ivanov]

ok - the issue is somewhere in your dns setup (it might also be only a caching issue - if that IP was listed by spamhaus (which I doubt, since it's their testing ip)

the output here:

dig  101.89.168.199.zen.spamhaus.org
\
; <<>> DiG 9.16.27-Debian <<>> 101.89.168.199.zen.spamhaus.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 41891
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;101.89.168.199.zen.spamhaus.org. IN    A

;; AUTHORITY SECTION:
zen.spamhaus.org.    10    IN    SOA    need.to.know.only. hostmaster.spamhaus.org. 2209150957 3600 600 432000 10

;; Query time: 55 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Thu Sep 15 11:59:50 CEST 2022
;; MSG SIZE  rcvd: 124

(the nxdomain says that there is not entry - thus it's not listed)

check the resolver at 192.168.0.22

 

[gck303]

Wow. Thank you. I changed the DNS to quad9 (9.9.9.9) and it seems to be working.

I was originally using google (8.8.8.8) and cloudflare (1.1.1.1) and neither seems to work.

Do you think that this is what the problem was, and the best way to correct it?

 

[Stoiko Ivanov]

Do you think that this is what the problem was, and the best way to correct it?

the second problem yes - regarding the first one - not so sure (but that needs to be fixed in PMG)

regarding the best DNS setup for mail - I'd suggest to install a recursive DNS directly on your PMG (with 9.9.9.9, 1.1.1.1, 8.8.8.8,... you're certain to run into the rate-limits by most useful DNSBL providers)

We have a getting started page in the PMG wiki - follow the advice there (also in the linked pages) to give you a good initial setup:
https://pmg.proxmox.com/wiki/index.php/Getting_started_with_Proxmox_Mail_Gateway

 

[gck303]

I ended up using barracuda. It seems to work correctly.

The spamhaus gives some strange dig results. I am not sure if that is because the IP that is querying has a rDNS entry. I would have throught all email servers would have a rDNS, so it seems like a strange problem.

Thank you so much for your help.

 

[Stoiko Ivanov]

I would still make sure that your DNS setup works - and spamhaus does work in general (we have it configured without any issues)...
there seems to be a recent change in their policy:
https://forum.proxmox.com/threads/probleme-mit-spamhaus.113883/#post-494018
(post is in german - but the link should be in english)