How to use SURBL?

Discussion in 'ISPConfig 3 Priority Support' started by spanish, Jan 31, 2018.

  1. spanish

    spanish Member HowtoForge Supporter

    Hello,
    I would like to use SURBL (multi.surbl.org) in my email server. How can I get this?
    • Debian GNU/Linux 8
    • ISPConfig 3.1.6
    Thanks,
    Manuel
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    You can add RBL's under System > server config > mail in ISPConfig.
     
  3. spanish

    spanish Member HowtoForge Supporter

    I only need add multi.surbl.org to this field? Nothing else? Thanks! Manuel
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes, just add the URI of the RBL that you want to use.
     
    spanish likes this.
  5. spanish

    spanish Member HowtoForge Supporter

    After adding multi.surbl.org all inbound email is rejected with this log:
    554 5.7.1 Service unavailable; Client host [1.2.3.4] blocked using multi.surbl.org
    Any idea?
    Thanks,
    Manuel
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    This means that the IP address that the server receives these emails from are on multi.surbl.org blacklist. Is your server connected directly to the internet? or does it receive emails from a smart host or similar?
     
  7. spanish

    spanish Member HowtoForge Supporter

    My environment:
    • Dedicated Server (Debian 8 and Proxmox 4.4). IP not blacklisted.
    • Virtual Machine (LXC with Debian 8 and ISPConfig 3.1.6). IP not blacklisted.
    • No intermediate mailserver.
    When I add multi.surbl.org, all external inbound emails are rejected. The senders IP are not blacklisted.
    Any idea?
    Thanks,
    Manuel
     
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    And the server is directly connected to the internet, so the incoming emails do not come from any kind of smarthost? Please post a few lines from your log that show the rejects.
     
  9. spanish

    spanish Member HowtoForge Supporter

    Yes (this is a normal installation following your tutorial).

    Feb 15 15:49:30 myserver postfix/smtpd[4073]: connect from mail-wr0-f180.google.com[209.85.128.180]

    Feb 15 15:49:30 myserver postfix/smtpd[4073]: NOQUEUE: filter: RCPT from mail-wr0-f180.google.com[209.85.128.180]: <[email protected]>: Sender address triggers FILTER amavis:[127.0.0.1]:10026; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-wr0-f180.google.com>
    Feb 15 15:49:30 myserver postfix/smtpd[4073]: NOQUEUE: filter: RCPT from mail-wr0-f180.google.com[209.85.128.180]: <[email protected]>: Sender address triggers FILTER amavis:[127.0.0.1]:10024; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-wr0-f180.google.com>

    Feb 15 15:49:30 myserver postgrey[16576]: action=pass, reason=client whitelist, client_name=mail-wr0-f180.google.com, client_address=209.85.128.180, sender=[email protected], recipient=[email protected]
    Feb 15 15:49:30 myserver postgrey[16576]: action=pass, reason=client whitelist, client_name=mail-wr0-f180.google.com, client_address=209.85.128.180, sender=[email protected], recipient=[email protected]

    Feb 15 15:49:30 myserver postfix/smtpd[4073]: NOQUEUE: reject: RCPT from mail-wr0-f180.google.com[209.85.128.180]: 554 5.7.1 Service unavailable; Client host [209.85.128.180] blocked using multi.surbl.org; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-wr0-f180.google.com>

    Feb 15 15:49:30 myserver postfix/smtpd[4073]: disconnect from mail-wr0-f180.google.com[209.85.128.180]

    Notes:
    1. 209.85.128.180 is not blacklisted according to http://www.surbl.org/surbl-analysis
    2. I see 2 logs duplicated: is this normal?
    Thanks,
    Manuel
     
  10. Croydon

    Croydon ISPConfig Developer ISPConfig Developer

    May it be that your server uses a local dns relay that is misconfigured?
    Have you try doing a check from command line manually, e.g.
    Code:
    dig 180.128.85.209.multi.surbl.org
     
    spanish likes this.
  11. spanish

    spanish Member HowtoForge Supporter

    Thanks:

    # dig 180.128.85.209.multi.surbl.org

    ; <<>> DiG 9.9.5-9+deb8u15-Debian <<>> 180.128.85.209.multi.surbl.org
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 31858
    ;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; WARNING: recursion requested but not available

    ;; QUESTION SECTION:
    ;180.128.85.209.multi.surbl.org. IN A

    ;; Query time: 0 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Thu Feb 15 16:37:27 CET 2018
    ;; MSG SIZE rcvd: 48
     
  12. till

    till Super Moderator Staff Member ISPConfig Developer

    Ok, so it seems to be a dnsconfig problem. Check the /etc/resolv.conf file and ensure that you have dns servers in there that allow external resolving. e.g. the free google namervers 8.8.8.8 and 8.8.4.4
     
    spanish likes this.
  13. spanish

    spanish Member HowtoForge Supporter

    I added 8.8.8.8 and 8.8.4.4 nameservers to resolv.conf, but nothing has changed:
    # touch /etc/.pve-ignore.resolv.conf
    # vi /etc/resolv.conf
    Code:
    # --- BEGIN PVE ---
    search ip-1-2-3.eu
    nameserver 127.0.0.1
    nameserver 213.186.33.99
    nameserver 8.8.8.8
    nameserver 8.8.4.4
    # --- END PVE ---
    Notes:
    • search ip-1-2-3.eu = OVH domain of the dedicated server.
    • nameserver 213.186.33.99 = OVH cache DNS infrastructure.
    # reboot
    # dig 180.128.85.209.multi.surbl.org
    Code:
    ; <<>> DiG 9.9.5-9+deb8u15-Debian <<>> 180.128.85.209.multi.surbl.org
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 12814
    ;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; WARNING: recursion requested but not available
    
    ;; QUESTION SECTION:
    ;180.128.85.209.multi.surbl.org.   IN   A
    
    ;; Query time: 0 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Fri Feb 16 01:31:11 CET 2018
    ;; MSG SIZE  rcvd: 48
    And the same multi.surbl.org false positives and logs.
    Any idea?
    Thanks!
    Manuel
     
  14. Taleman

    Taleman Active Member HowtoForge Supporter

    Remove localhost from resolv.conf.
     
    spanish likes this.
  15. spanish

    spanish Member HowtoForge Supporter

    Removed (commented out) localhost and rebooted virtual machine and dedicated server.
    Now, dig has an answer:
    Code:
    # dig 180.128.85.209.multi.surbl.org
    
    ; <<>> DiG 9.9.5-9+deb8u15-Debian <<>> 180.128.85.209.multi.surbl.org
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48647
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;180.128.85.209.multi.surbl.org.    IN    A
    
    ;; ANSWER SECTION:
    180.128.85.209.multi.surbl.org.    86400 IN A    127.0.0.1
    
    ;; Query time: 66 msec
    ;; SERVER: 213.186.33.99#53(213.186.33.99)
    ;; WHEN: Mon Feb 19 01:00:09 CET 2018
    ;; MSG SIZE  rcvd: 75
    But I still have the same problem: when I add multi.surbl.org, all incoming mail is blocked.
    :-(
    Any idea? (sorry)
    Thanks,
    Manuel
     
  16. spanish

    spanish Member HowtoForge Supporter

    Finally, I have started using dnsbl.spfbl.net (this list is working perfectly, without errors).
    Thank you very much for your help!
    Manuel
     
    ahrasis likes this.

Share This Page