0

I have a postfix setup similar to ISPconfig.org's ruleset. Because of a failing RBL (SERVFAIL DNS response), Postfix rejected many incoming messages with a 451 4.7.1. type temporary failure instead of reporting the real error message:

NOQUEUE: reject: RCPT from x[y] 450 4.7.1 <y>: Client host rejected:
  Service unavailable; from=<bounce@x> to=<x@y> proto=ESMTP helo=<x>

This is like what I would expect:

NOQUEUE: reject: RCPT from x[y] 450 4.7.1 <y>: Client host rejected: 
  Service unavailable; Client host [x] blocked using zen.spamhaus.org; 
  https://www.spamhaus.org/sbl/query/SBLCSS / 
  https://www.spamhaus.org/query/ip/x; from=<bounce@x> to=<x@y> 
  proto=ESMTP helo=<x>

I would like to be less dependant on temporary failures of RBLs and specify that SERVFAIL responses should be ignored (treated as though the RBL wasn't specified at all). Or better yet, be able to specify a timeout "tempfail" response so that when a RBL fails for more than X minutes, it is simply ignored until Postfix is restarted.

From a users perspective, a temporarily slightly worse spam filter is much less severe than mails being delayed until the admin decides to have a look.

Are there any mechanisms in Postfix (3.1, Ubuntu 16.04 LTS) to allow this?

Improve this question
5
  • I'd be more concerned with Service unavailable message than log verbosity. At first make sure all rbl services works properly.
    – Paweł Tatarczuk
    Nov 5, 2017 at 19:49
  • It's not a RBL (I used the host specific debugging log feature). Some are rejected due to users not being found in the (MySQL based) virtual mail table, some are rejected because listed in RBLs. But the error messages never show this.
    – Jens
    Nov 5, 2017 at 20:50
  • Correction: it was a non-working RBL (my new IP wasn't activated on their end yet). I didn't realize that a non-working RBL could temporarily disable mail delivery. Now I wonder if there's a way to ignore SERVFAIL responses from RBLs in Postfix?
    – Jens
    Nov 5, 2017 at 21:10
  • I only know warn_if_reject directives and so on... but none of those can handle this issue. Maybe some custom policy service?
    – Paweł Tatarczuk
    Nov 5, 2017 at 21:18
  • @Jens Please update the question, maybe someone else can help.
    – Paweł Tatarczuk
    Nov 5, 2017 at 21:35

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .