14 votes

What are the best methods for catching snowshoe spam?

Is this becoming a real problem for your users? I'd recommend a full-on mail filtering service at this point. Bayesian isn't really that hot anymore. Reputation, RBL, header/intent-analysis and other ...
  • 195k
9 votes

how to specify a partial domain in blacklist with SpamAssassin

The SpamAssassin whitelist and blacklist options can include globs, not regular expressions. The valid metacharacters are ? and * to match 0-1 or 0-many characters respectively. This is the same as a ...
8 votes
Accepted

How Does DNSWL work? How can I gain better trust?

DNSWL usually refers to DNSWL.org but can more generally refer to the DNS-based Whitelist concept itself, which is the reverse of a DNS Blocklist (DNSBL, a.k.a. DNS Blacklist, Blackhole List, or its ...
  • 869
8 votes

Remove blacklist from spamRATS

SpamRats is a very unreliable blacklist. They basically ignore everyone including ISPs, so there are always a good number of innocent sites listed by their system. Ignore or remove Spamrats and use ...
8 votes

What are the best methods for catching snowshoe spam?

I'm a DNS Ops guy who works closely with a group who is frequently subject to these attacks. Dealing with Snowshoe attacks is primarily a process problem, and as ewwhite points out it may beyond the ...
  • 32k
6 votes

Remove blacklist from spamRATS

SpamRats is a cheating "company" that is adding whole IP ranges and after than they try to sell you commercial services provided by their official companies ... if you write them an email with demand ...
  • 61
6 votes
Accepted

What is meant by '550 Relay not Permitted' when it comes to emails?

This message "Relay access denied" or "Relay not permitted" means that the mail server received a message for a recipient at a domain that it doesn't handle email for, and it is refusing to accept it ...
5 votes

Remove blacklist from spamRATS

RATS-Dyna means an IP range not a single IP address. It is for spammy neighborhoods. So check who is in charge of that range. The provider of the range needs to address the individual users. RATS-...
  • 51
5 votes
Accepted

How to whitelist an ip range blacklisted by Spamcop

The simple answer is you cannot - SpamCop provides no way to remove your IP range from the Blacklist or add yourself to the Whitelist. You have a few options here: 1) Stop actually sending email for ...
5 votes

Spamassassin: Bypass /etc/resolv.conf DNS for querying DNSBL?

Spamassassin (Mail::SpamAssassin::DnsResolver) uses Net::DNS::Resolver perl module. It should allow you to change nameservers spamassassin uses via RES_NAMESERVERS environment variable.
  • 5,968
5 votes

Why the ip can't be banned with postfix blacklist?

Because the check_sender_access is a smtpd_sender_restriction and, therefore, performed for the MAIL FROM address, domain, parent domains, or localpart@, and execute the corresponding action. If ...
  • 43.6k
4 votes
Accepted

Postfix Localhost Server Sending Spam to Itself

This email came from outside your server, from the indicated IP address. Postfix is configured to pass it to Amavis for virus scanning, and when that is complete, Amavis passes it back to Postfix for ...
4 votes

How configure Postfix to check external blacklists?

You can do that by adding to main.cf under smtpd_recipient_restrictions at the end before permit: smtpd_recipient_restrictions ..... reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus....
4 votes

How configure Postfix to check external blacklists?

I identified the problem. My server was configured to resolve domains with Google Public DNS, which doesn't work very well with SPAMHAUS (https://www.spamhaus.org/faq/section/DNSBL%20Usage#261). I ...
3 votes

Unable to resolve IP Blacklisting with Spamhaus

Removal of dynamic IP addresses from the Spamhaus blocklist is not desirable. The RFCs support such blocking, and these blocks allow a lot of spam to be blocked. Spamhaus documentation covers this ...
  • 27.4k
3 votes

False IP blacklisting on CBL and Spamhaus ZEN

I'm coming in late, but: You are no longer on the Spamhaus list. CBL has removed you, but explains: IP Address 23.239.30.81 is not listed in the CBL. It was previously listed, but was removed ...
3 votes

False IP blacklisting on CBL and Spamhaus ZEN

I would highly recommend to go through the CBL and Spamhuas websites again, because they have all the information you need to start with troubleshooting and safeguarding your server. The information ...
  • 8,861
3 votes
Accepted

Postfix: Resend 'hard' bounces

You can use smtp_reply_filter feature to transform hard reject to soft reject when sending email. The idea was given by this thread. In main.cf, add this line smtp_reply_maps = pcre:/etc/postfix/...
  • 18.1k
3 votes

Preventing operating systems from being installed on a server

Prevent operating systems from being installed by users period. Hire administrators that follow procedures and forbid them from installing anything but your approved OS images. Monitor for ...
  • 73k
3 votes
Accepted

Blocking clients by IP using dynamic list in NGINX

What you want to do is basically Fail2ban. https://www.fail2ban.org/ In your PHP script, you could log the login tentatives, and then parse&act on that with Fail2ban.
  • 228
2 votes

Postfix SMTP recipient filter not filtering

Restrictions specified in restriction lists such as smtpd_helo_restrictions, smtpd_recipient_restrictions etc. are applied in the order as specified; the first restriction that matches wins. Since ...
  • 651
2 votes

Use IPtables or null route for blacklisting about 1 million IP addresses?

For posterity: according to ipset docs the default size of a set is 65536, this can be changed by options. maxelem This parameter is valid for the create command of all hash type sets. It does ...
  • 131
2 votes
Accepted

Exim: silently drop messages to given recipients?

dropper: driver = accept condition = ${lookup{$local_part}lsearch{/path/drop.list}{yes}} transport = null_transport /path/drop.list : aaron amanda bob . . . . . ...
  • 6,864
2 votes
Accepted

How to add an email to an international Spam Blacklist

I know that it might be annoying. Still the answer to your question is: No. You cannot just add a huge company to a block list based on your own opinions. Someone actually wants to get email from ...
  • 43.6k
2 votes
Accepted

Exim server and blacklist for too much login attemps

It looks like a poorly done hacking attempt. I've seen a few of them. I would recommend using fail2ban to block the IP on multiple failures. You should verify the patterns as the default patterns ...
  • 27.4k
2 votes
Accepted

Why is my mail server blacklisted (graylisting failiure)?

Greylisting is not a cause of your problem, your server behaved correctly. The purpose of greylist is just to check if you are able to retry (most spammers don't bother with retrying). Then you've ...
  • 13.6k
2 votes

Google detect mail as spam, server is not on blacklists, got 550-5.7.1 likely unsolicited mail

Sending the email to google user is always be a challenge, out of 1000+ factors Gmail mainly consider the sending domain and IP reputation. You have to build a good reputation in front of Gmail. ...
2 votes
Accepted

Remove AS that's falsely associated with our IP from email block list

There is a misunderstanding. AS does mean Anti Spam, it's a rule number and not an Autonomous System Number. So you are just running in an ordinary spam protection rule at outlook.
  • 4,225
2 votes
Accepted

How does Bind9 work as a private DNS, to get past URIBL Query Refused?

I think you're getting confused by how bind would work as a caching nameserver. A DNS forwarder really only comes into play when you're speaking from a client perspective, and isn't relevant in the ...
  • 188
2 votes
Accepted

Fixing a server that has been listed an Email Spam

Blocklist Lookup Results 77.68.13.98 is not listed in the SBL 77.68.13.98 is not listed in the PBL 77.68.13.98 is not listed in the XBL Based on the current results your issue #2 is already ...
  • 43.6k

Only top scored, non community-wiki answers of a minimum length are eligible