Join Log in
Score:0
Claudio avatar Server

How to whitelist our own outgoing emails from being blocked in amavis/spamassassin using Spamhaus' block lists?

cn flag
Claudio

Just after we implemented spam filtering on our Postfix server using spamassassin-dqs through amavisd-new we drastically reduced received spam, but to our surprise our own outgoing e-mails are being blocked as well. Our server runs on a AWS EC2 instance, so I suppose our office's ISP IP Block might be on some of Spamhaus blocklists and when spamassassin sees it is comming from there it blocks our own e-mails from being sent.

Is there a way to whitelist our own e-mail senders (they are being authenticated through SASL) so only them are not subjected to spamassassin filtering?

Down here is an example taken from /var/log/mail.log when I just tried to send an e-mail. See an Anonymous TLS connection is stablished to our server, but from "unkonwn" (I supposed a SASL authenticated user would not be 'unknown', but I don't fully understand that...). Any ideas?

Jan 25 19:31:06 helpocorp postfix/submission/smtpd[1954]: Anonymous TLS connection established from unknown[187.20.170.32]: TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
Jan 25 19:31:07 helpocorp postfix/submission/smtpd[1954]: NOQUEUE: reject: RCPT from unknown[187.20.170.32]: 554 5.7.1 Service unavailable; Client host [187.20.170.32] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/187.20.170.32; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.10.10]>
Jan 25 19:31:07 helpocorp postfix/submission/smtpd[1954]: lost connection after RCPT from unknown[187.20.170.32]
Jan 25 19:31:07 helpocorp postfix/submission/smtpd[1954]: disconnect from unknown[187.20.170.32] ehlo=2 starttls=1 auth=1 mail=1 rcpt=0/1 commands=5/6
153
1 + 2
anx avatar
fr flag
anx
You can setup different smtpd_*_restrictions on different postfix instances - you clearly have a dedicated line in your master.cf where such settings could be overridden. See the tag description for more info on how to [share your configuration](https://serverfault.com/posts/1121153/edit) in a way an answer can directly address the problem for you.
0
Reply
Claudio avatar
cn flag
Claudio
Hey @anx, thanks for your feedback, but I guess I just found the problem fussing around. I had placed the reject directives related to querying Spamhaus blocklists right in the start of the `smtpd_client_restrictions` section (before the `permit_sasl_authenticated` directive), so it seems it was kind of quitting before it got there. I changed their ordering and it just worked! Thanks anyway for the tips.
0
Reply
Score:0
Claudio avatar Server
cn flag
Claudio

After much fiddling and reading around I read something somewhere about order being important in smtpd_client_restrictions, so I thought, maybe these "reject" directives related to spamassassin-dqs being in first place were causing the whole checking to quit once it found the IP in the blocking list, so I tried to put permit_sasl_authenticated before those and it just worked!

+ 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.