spamhaus start blocking some emails (FIXED)

Hello,
Some customers reported that some emails were not arraving with files attached, (plain text emails made it).
Checking the logs found message "Jan 17 11:29:48 mxserver6 postfix/smtpd[2965310]: NOQUEUE: reject: RCPT from server: 554 5.7.1 Service unavailable; Client host [xx.xx.xx.xx] blocked using zen.spamhaus.org; Error: excess volume; https://check.spamhaus.org/returnc/vol/209.126.15.52/; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<server.com>".
Doing research I found this link https://www.spamhaus.com/product/help-for-spamhaus-public-mirror-users/ than fit with my issue.
I have two workaround, the firts one remove the "zen.spamhaus.org" from Real-time Blackhole List field and the other one leave the field as it and manually change the smtpd_client_restrictions line to update the line to "reject_rbl_client zen.spamhaus.org=127.0.0.[2..11]"

Does anyone knows if the both workaround are the same? I mean if l leave reject_rbl_client zen.spamhaus.org=127.0.0.[2..11] has any advantage in compares if I remove it completly?
Thank you

 

Hi
Thanks to Till for this hint. As I observed the same problem on any of my ISPCOnfig Servers since yesterday it helped me out a little.
I just removed spamhouse for now but would like to have some blackhole list.
Does anybody know of other good lists?

Greetings
Bernd

 

Is there a good Howto, how to change from Amavisd to Rspamd?

 

Another "Thanky you" ;-)
I Will give this a try in the near future.

 

Hi there. All my incoming and outgoing mails "magically" were blocked from yesterday....."they" must have changed some configs. at Spamhaus.....My setup is Ubuntu 20.04.6 LTS (Focal Fossa) with ISPConfig 3.2.7p1.
Error messages are like:-
Welcome response error: 5.7.1 Service unavailable; Client host [xx.xxx.xxx.xx] blocked using cbl.abuseat.org; Error: open resolver; https://check.spamhaus.org/returnc/pub/xxxxxxxx/".
I went through all the docs on the spamhaus website......they recommend you configer a mail fllter and integrate it with spamassassin or rspamd on postfix.
So, my plan of action is:-
1. Check the current config in postfix main.cf and possibly back it up before changing anything.
2. Change it via the ispconfig control panel. The change I need to do is remove the spamhaus RBL
3. Check that the main.cf was changed as expected.
4. Set up rspamd to do my mail filtering.
NB I have ISPCONFIG 3.2.7 so this should possibly be posted in the forum for that version ? Not sure exactly...anyway...it's regarding the same topic......
So, I'm gunna do that now and I'll post all the steps I did to make it work again here.

 

Regarding how this work is going:-
1. I can't find where to edit the main.cf from within ispconfig 3.2.7p1 control panel. Nothing seems to be configured in that respect ?
So, I just manually editted the /etc/postfix/main.cf file.
2. To get the mail system working again, I removed reject_rbl_client cbl.abuseat.org from smtpd_client_restrictions and smtpd_recipient_restrictions
3. After you changed the main.cf file, then, you have to restart postfix:-
service postfix restart
4. To monitor whats going on in your mail system, you can do the following command:-
tail -f /var/log/mail.log
Next thing is I will try to set up rspamd......

 

ispconfig gui
system -> server config -> select mailserver -> mail tab -> Real-time Blackhole List

 

The next fire to put out was to try to get e-mail up again.
I checked in the following log file:-
/var/log/mail.err
There were lots of error messages as follows:-
postfix/smtpd[14372]: fatal: proxymap service is not configured for table "mysql:/etc/postfix/mysql-virtual_sender.cf"
I googled it and found a thread on howtoforge which has the same error message in it.
So, using the fix posted in that thread, I editted my /etc/postfix/main.cf file.
I located the line which begins with:-
proxy_read_maps =
I then appended the following to the end of it:-
proxy:mysql:/etc/postfix/mysql-virtual_sender.cf
I then re-started postfix, and e-mail is now working again.

 

I think those changes in #11 are overwritten when ISPConfig next time updates and writes those files.
You should have done what @nhybgtvfr suggested in #10, that is remove the Spamhaus blackists from there.
If you want to continue using them, read these:

• https://forum.howtoforge.com/threads/real-time-blackhole-list-rbl-problems-with-spamhaus.89441/
  
• https://www.spamhaus.com/product/help-for-spamhaus-public-mirror-users/