1

I'm getting the combination of these Postfix infos and I was wondering if I should be aware of something / someone.

30.4.2018, 10:08:33 info    statistics: max cache size 1 at Apr 30 10:05:13
30.4.2018, 10:08:33 info    statistics: max connection count 1 for (smtpd:87.243.7.183) at Apr 30 10:05:13
30.4.2018, 10:08:33 info    statistics: max connection rate 1/60s for (smtpd:87.243.7.183) at Apr 30 10:05:13
30.4.2018, 10:05:13 info    disconnect from unknown[87.243.7.183] helo=1 auth=0/1 quit=1 commands=2/3
30.4.2018, 10:05:13 info    connect from unknown[87.243.7.183]
30.4.2018, 10:05:13 warning warning: hostname 183.7.243.87.static.primetelecom.ro does not resolve to address 87.243.7.183: Name or service not known
30.4.2018, 10:05:12 info    PASS OLD [87.243.7.183]:64492
30.4.2018, 10:05:09 info    addr 87.243.7.183 listed by domain zen.spamhaus.org as 127.0.0.4
30.4.2018, 10:05:09 info    Look up 87.243.7.183 on whitelist, result 200 DUNNO
30.4.2018, 10:05:09 info    CONNECT from [87.243.7.183]:64492 to [172.22.1.6]:25
30.4.2018, 09:56:57 info    DISCONNECT [182.176.115.31]:54308
30.4.2018, 09:56:57 info    DNSBL rank 14 for [182.176.115.31]:54308
30.4.2018, 09:56:55 info    addr 182.176.115.31 listed by domain zen.spamhaus.org as 127.0.0.4
30.4.2018, 09:56:55 info    addr 182.176.115.31 listed by domain zen.spamhaus.org as 127.0.0.11
30.4.2018, 09:56:54 info    Look up 182.176.115.31 on whitelist, result 200 DUNNO
30.4.2018, 09:56:54 info    CONNECT from [182.176.115.31]:54308 to [172.22.1.6]:25
30.4.2018, 09:51:40 info    statistics: max cache size 1 at Apr 30 09:48:20
30.4.2018, 09:51:40 info    statistics: max connection count 1 for (smtpd:87.243.7.183) at Apr 30 09:48:20
30.4.2018, 09:51:40 info    statistics: max connection rate 1/60s for (smtpd:87.243.7.183) at Apr 30 09:48:20
30.4.2018, 09:50:00 info    DISCONNECT [185.234.216.221]:59101
30.4.2018, 09:50:00 info    DNSBL rank 9 for [185.234.216.221]:59101
30.4.2018, 09:50:00 info    addr 185.234.216.221 listed by domain b.barracudacentral.org as 127.0.0.2
30.4.2018, 09:49:57 info    addr 185.234.216.221 listed by domain zen.spamhaus.org as 127.0.0.4
30.4.2018, 09:49:57 info    addr 185.234.216.221 listed by domain zen.spamhaus.org as 127.0.0.2
30.4.2018, 09:49:57 info    PREGREET 11 after 0.03 from [185.234.216.221]:59101: EHLO User\r\n
30.4.2018, 09:49:56 info    Look up 185.234.216.221 on whitelist, result 200 DUNNO
30.4.2018, 09:49:56 info    CONNECT from [185.234.216.221]:59101 to [172.22.1.6]:25
30.4.2018, 09:48:20 info    disconnect from unknown[87.243.7.183] helo=1 auth=0/1 quit=1 commands=2/3
30.4.2018, 09:48:20 info    connect from unknown[87.243.7.183]
30.4.2018, 09:48:20 warning warning: hostname 183.7.243.87.static.primetelecom.ro does not resolve to address 87.243.7.183: Name or service not known

There are some parts like Look up 182.176.115.31 on whitelist, result 200 DUNNO or PASS OLD [87.243.7.183]:64492 which I do not really understand. What does PASS OLD or PASS NEW mean? I googled for it and read something about spam prevention, but for me this looks like spam, so why is postfix preventing the IP from it?

1 Answer 1

1

Take a look at the "postscreen" feature of postfix:

http://www.postfix.org/POSTSCREEN_README.html

RBL-Checks to differnt RBL-services are made, to check if the sending mail server is known as a spammer.

The DNSBL rank log entry shows the ranked value of all tests. If this exceeds postscreen_dnsbl_threshold which is a mostly configured by 3, the server rejects the mail, and ask the sender to try again later. Most spammers will not do this, since they only try to push out as much as they can, without trying to re-send.

Postscreen will remember a connection try from a specific sending server and the receiving mail-address.

If the postscreen_dnsbl_threshold was not reached, a later try will let the mail pass (logging it with PASS NEW).

If the server re-sends the mail after a few minutes, postscreen will allow it (logging it with PASS OLD),

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .