I have my self-hosted e-mail server. There is no current problem of being blacklisted but I want to be proactive about it and I want to start with the log files.
There have been some entries in my log files indicating a blacklist/greylist of my IP or some kind of rate limitation :
Example 1 - greylisting
Sep 28 10:12:49 server postfix/smtp[7872]: 33AE9C2239: host mxcluster2.one.com[91.198.169.9] said: 450 4.7.1 <redacted@redacted>: Recipient address rejected: redactedServerIP temporary greylisted by CYREN IP reputation (in reply to RCPT TO command)
Example 2 - google rate limiting
Oct 22 09:22:30 server postfix/smtp[2048]: C28CAC0855: host gmail-smtp-in.l.google.com[74.125.136.27] said: 421-4.7.0 [redactedServerIP 10] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originI ating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 https://support.google.com/mail/answer/81126 to review our Bulk Email 421 4.7.0 Senders Guidelines. hw7si16653285wjb.208 - gsmtp (in reply to end of DATA command)
I want have an automated way that would inform me about such events. My initial idea was to use fail2ban, filter with some regex (I only have 2 examples make a pattern from) and send an email as action. Other starting points / examples for regex matching might be general SMTP error codes or from various providers.
In parallel, I'm monitoring blacklists to see if my IP address pops up but I want to see it from the logs too.
My questions :
- Is there a better way (e.g. specialized software for this) to do this, rather than using fail2ban ?
- Are there any more resources on response codes / warnings on blacklists that I should know about for the current case ?