Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have my postfix main.cf configured with a number of blacklists:

smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_non_fqdn_sender,
    reject_non_fqdn_recipient,
    reject_unknown_sender_domain,
    reject_unknown_recipient_domain,
    reject_unauth_pipelining,
    reject_invalid_hostname,
    reject_non_fqdn_hostname,
    reject_rbl_client opm.blitzed.org,
    reject_rbl_client zombie.dnsbl.sorbs.net,
    reject_rbl_client cbl.abuseat.org,
    reject_rbl_client multi.uribl.com,
    reject_rbl_client dsn.rfc-ignorant.org,
    reject_rbl_client dul.dnsbl.sorbs.net,
    reject_rbl_client sbl-xbl.spamhaus.org,
    reject_rbl_client bl.spamcop.net,
    reject_rbl_client dnsbl.sorbs.net,
    reject_rbl_client ix.dnsbl.manitu.net,
    reject_rbl_client combined.rbl.msrbl.net

An incoming mail was just rejected because it appeared on one of these lists (sorbs.net) but not on the others. Is it possible to configure postfix to only reject if 2 or more lists contain that IP address? I'm hoping this will remove false matches...

share|improve this question
    
I've been reading about the different lists and it seems that sorbs.net has a tendency to add IPs a little too easily. I'm thinking of just removing those from my config. –  Nicholas Tolley Cottrell Jan 31 '13 at 11:21
add comment

2 Answers 2

up vote 3 down vote accepted

Upgrade your postfix version to at least 2.8, and configure postscreen.

It supports complex weighting and thresholds for individual DNSBLs

share|improve this answer
    
Gosh - I'm on Centos5 still and have only 2.3.3... –  Nicholas Tolley Cottrell Jan 31 '13 at 13:20
    
Postfix 2.**5** is no longer supported; 2.3 has been EOL for a few years. –  adaptr Jan 31 '13 at 13:33
add comment

AFAIK what you ask is not possible with a standard postfix configuration. However, you could delegate the RBL checks to a postfix policy daemon that would do some custom checking of your own.

I'd suggest you have a look at the list of such daemons provided on the Postfix website. One of them might suit your needs. I've not used any of those but, looking at the documentation, the following seems particularly useful:

  • Gross: does RBL checks and greylisting and combine them in different ways,
  • policyd-weight: scores an incoming message depending on header contents, RBL checks and some other DNS queries, then accept or discards the message if the score is too high,
  • postfwd: does a lot more other things too (might be overkill for your needs),
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.