check_client_access and RBLs

Question

In an attempt to better fight spam, I've configured Postfix like this:

smtpd_client_restrictions =

    check_client_access hash:/etc/postfix/client_whitelist
    reject_unknown_client

smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination
    reject_non_fqdn_sender,
    reject_non_fqdn_recipient,
    reject_unknown_sender_domain,
    reject_unknown_recipient_domain,
    reject_unauth_destination,
    reject_unauth_pipelining,
    reject_invalid_hostname,
    reject_rbl_client zen.spamhaus.org,
    reject_rbl_client bl.spamcop.net,
    reject_rbl_client l2.apews.org,
    permit

This config has reduced a lot of spam, and with the whitelist I was able to deal with some misconfigured but legitimate servers in order to accept them. However, I'm wondering if this particular whitelisting config will be able to do the job if some other legitimate servers found themselves blacklisted in one of these RBLs. Am I missing something?

Answer 1

In case an "innocent" mail server is on one of your configured RBLs and not in your whitelist, the e-mail simply is discarded.

If you want to protect yourself against that, you need to move to RBL scoring rather than direct RBL blocking. One good way to do that is with the use of policyd-weight scoring daemon. It'll be integrated into Postfix and works this way:

1. From now on, you configure your RBLs in policyd-weight where you can assign "hit-" and "non-hit"- scores to every RBL individually (so with the negative score you can even use whitelist RBLs).

2. Example: rbl1.example.org: Score 3.5, rbl2.foo.org: Score 4. Minimal score needed to block: 6

3. Now if an IP is listed in rbl2.foo.org but not in rbl1.example.org, it won't be rejected because it didn't reach the required minimal score of 6.

This solution also protects you from dead RBLs. If they "die", the RBL often answers all queries with 127.0.0.2 which means "listed" in order to catch your attention. But until you detect that error a lot of legitimate e-mail would be lost.

Answer 2

You could also try using postfix's permit_dnswl_client directive (if you are on postfix 2.8+), eg. this is one I use in my config:

permit_dnswl_client list.dnswl.org

I use several RBLs in my config, but some are more aggressive and list IPs from webmail providers (eg. AOL, gmail, yahoo), so the whitelist, which I define before the RBLs, lets those IPs pass through.