0

I have my self-hosted e-mail server. There is no current problem of being blacklisted but I want to be proactive about it and I want to start with the log files.

There have been some entries in my log files indicating a blacklist/greylist of my IP or some kind of rate limitation :

Example 1 - greylisting

Sep 28 10:12:49 server postfix/smtp[7872]: 33AE9C2239: host mxcluster2.one.com[91.198.169.9] said: 450 4.7.1 <redacted@redacted>: Recipient address rejected: redactedServerIP temporary greylisted by CYREN IP reputation (in reply to RCPT TO command)

Example 2 - google rate limiting

Oct 22 09:22:30 server postfix/smtp[2048]: C28CAC0855: host gmail-smtp-in.l.google.com[74.125.136.27] said: 421-4.7.0 [redactedServerIP      10] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originI ating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/answer/81126 to review our Bulk Email 421 4.7.0 Senders Guidelines. hw7si16653285wjb.208 - gsmtp (in reply to end of DATA command)

I want have an automated way that would inform me about such events. My initial idea was to use fail2ban, filter with some regex (I only have 2 examples make a pattern from) and send an email as action. Other starting points / examples for regex matching might be general SMTP error codes or from various providers.

In parallel, I'm monitoring blacklists to see if my IP address pops up but I want to see it from the logs too.

My questions :

  1. Is there a better way (e.g. specialized software for this) to do this, rather than using fail2ban ?
  2. Are there any more resources on response codes / warnings on blacklists that I should know about for the current case ?

1 Answer 1

0

I'm not familiar with Fail2ban but your approach seems correct. You may not receive a message in your logs indicating you are blacklisted - this depends on the service that rejects your message if it gives you the rejection reason. That being said we've seen them where they explicitly state the IP has been blacklisted or is included in RBL - so you probably need to check for all of those keywords. I've seen 550 messages tied to this as well.

I would also be sure your SPF record is configured. More systems are not checking for valid SPF records in DNS and if they are non-existent or don't match they may get tagged. Too many of these reported may get you on a black list.

If you sending thru Google or another smart host for external relay - be sure you follow their usage guidelines. If you need to send bulk messages you may need to use another provider. Microsoft, Google, and others will shut down message relays if they think you've been compromised.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .