Current Effective RBL Setup for Postfix

postfix-rbl.md

Current Effective RBL Setup for Postfix

main.cf:

    smtpd_recipient_restrictions =
      permit_mynetworks,
      permit_sasl_authenticated,
      reject_non_fqdn_hostname,
      reject_non_fqdn_sender,
      reject_non_fqdn_recipient,
      reject_unauth_destination,
      reject_unauth_pipelining,
      reject_invalid_hostname,
      reject_rbl_client bl.spamcop.net,
      reject_rbl_client cbl.abuseat.org,
      reject_rbl_client dnsbl.sorbs.net,
      reject_rbl_client zen.spamhaus.org

@farrokhi
zen.spamhaus.org is not working
May 2 17:47:14 XXXXX postfix/smtpd: warning: 173.216.85.209.zen.spamhaus.org: RBL lookup error: Host or domain name not found. Name service error for name=173.216.85.209.zen.spamhaus.org type=A: Host not found, try again May 2 17:54:25 XXXX postfix/smtpd: warning: 161.194.254.51.zen.spamhaus.org: RBL lookup error: Host or domain name not found. Name service error for name=161.194.254.51.zen.spamhaus.org type=A: Host not found, try again

dnsbl.sorbs.net rejects mails coming from Gmail servers.
I used warn_if_reject to find out who was blocking gmail, and:

May 2 17:47:14 XXXX postfix/smtpd[]: NOQUEUE: reject_warning: RCPT from mail-qt0-f173.google.com[209.85.216.173]: 554 5.7.1 Service unavailable; Client host [209.85.216.173] blocked using dnsbl.sorbs.net; Currently Sending Spam See: http://www.sorbs.net/lookup.shtml?209.85.216.173; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-qt0-f173.google.com> May 2 20:04:57 XXXX postfix/smtpd[]: NOQUEUE: reject_warning: RCPT from mail-qt0-f179.google.com[209.85.216.179]: 554 5.7.1 Service unavailable; Client host [209.85.216.179] blocked using dnsbl.sorbs.net; Currently Sending Spam See: http://www.sorbs.net/lookup.shtml?209.85.216.179; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-qt0-f179.google.com> May 2 20:16:20 XXXX postfix/smtpd[]: NOQUEUE: reject: RCPT from mail-it0-f44.google.com[209.85.214.44]: 554 5.7.1 Service unavailable; Client host [209.85.214.44] blocked using dnsbl.sorbs.net; Currently Sending Spam See: http://www.sorbs.net/lookup.shtml?209.85.214.44; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-it0-f44.google.com> May 2 20:17:22 XXXX postfix/smtpd[6800]: NOQUEUE: reject: RCPT from mail-io0-f174.google.com[209.85.223.174]: 554 5.7.1 Service unavailable; Client host [209.85.223.174] blocked using dnsbl.sorbs.net; Currently Sending Spam See: http://www.sorbs.net/lookup.shtml?209.85.223.174; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-io0-f174.google.com> May 2 20:18:34 XXXX postfix/smtpd[]: NOQUEUE: reject_warning: RCPT from mail-io0-f182.google.com[209.85.223.182]: 554 5.7.1 Service unavailable; Client host [209.85.223.182] blocked using dnsbl.sorbs.net; Currently Sending Spam See: http://www.sorbs.net/lookup.shtml?209.85.223.182; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-io0-f182.google.com> May 2 20:24:43 XXXX postfix/smtpd[]: NOQUEUE: reject_warning: RCPT from mail-io0-f181.google.com[209.85.223.181]: 554 5.7.1 Service unavailable; Client host [209.85.223.181] blocked using dnsbl.sorbs.net; Currently Sending Spam See: http://www.sorbs.net/lookup.shtml?209.85.223.181; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-io0-f181.google.com>

reject_non_fqdn_hostname was replaced with reject_non_fqdn_helo_hostname since Postfix 2.3

For zen.spamhaus.org you need to register an account and give them the IP and/or hostname for the mail server in use. If you don't do so, it will not allow you to use the service. I use zen.spamhaus.org and it works fine.

@siniztr Is that new? if so how so I do that? I do not see the option anywhere on the site.

@farrokhi Just FYI, I think cbl.abuseat.org is included in zen.spamhaus.org.

@siniztr and @tuaris, I could be wrong but I believe that's only for commercial and high volume usage.
Reference: https://www.spamhaus.org/organization/dnsblusage/
Signup if necessary: https://www.spamhaustech.com

Note, that some of my test servers use Zen without any signup.

Read here about zen and it's free usage requirements: https://www.spamhaus.org/zen/

Isn't it better to use postscreen and take care of the RBL stuff there?

I'm not sure if this is done with Postfix, but I would like to see if its possible (when using dovecot) to have postfix deliver mail from blocked hosts to a junk/spam folder.

@oktayaa the postscreen thing looks interesting. Is their an example setup to look at?

@tuaris I believe I used this as a reference. It also has a link to the documentation you need at the top.
http://rob0.nodns4.us/postscreen.html

cbl.abuseat.org should be removed. If it still works at all, it's a subset of zen.spamhaus.org, so it's a wasteful DNS lookup. See https://www.abuseat.org/cutover.html for details.

Also, for postscren documentation, see http://www.postfix.org/POSTSCREEN_README.html (or http://www.postfix.org/POSTSCREEN_3_5_README.html for older versions).