Mail server added to backscatterer blacklist

Discussion in 'ISPConfig 3 Priority Support' started by Taleman, Jul 30, 2019.

  1. Taleman

    Taleman Well-Known Member HowtoForge Supporter

  2. till

    till Super Moderator Staff Member ISPConfig Developer

    The most likely reason is that one of your accounts accepts emails which then get forwarded to another server which then rejects it. Example: you accept emails for [email protected] and forward it to [email protected], if gmail would reject an incoming email e.g. because it's spammy, then this email will probably become backscatter.
     
  3. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Contibuting factor may have been error in postfix main.cf. I noticed it had line
    Code:
    smtpd_recipient_restrictions = permit_mynetworks,
    That is everything missing after first comma. I believe this happened last week when I updated ISPConfig to 3.1.14p2. Maybe my conf-custom file was bad, I copied it again from install/tpl and added my modifications.
    Your diagnosis may be correct. It is indeed a problem with users forwarding their mails to GMail, I have constantly in mailq entries like
    Code:
    Our system has detected that this message is 421-4.7.0 suspicious due to the nature of the content and/or the links within. 421-4.7.0 To best protect our users from spam, the message has been blocked. 421-4.7.0 Please visit 421 4.7.0  https://support.google.com/mail/answer/188131 for more information.
     
  4. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    I fixed the postfix main.cf, but looks like graylisting still does not work. This is screenshot from mailgraph:
    [​IMG]
    Graylisting stopped right after updating ISPConfig. I did remember to restart postfix after modifying main.cf.
     
  5. till

    till Super Moderator Staff Member ISPConfig Developer

    Maybe you had greylisting enabled globally before, directly in main.cf? Or did you enable it on a per-mailbox basis with the checkbox in the mailbox settings? And postgrey is started?
     
  6. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    I have enabled greylisting per mailbox, in ISPConfig settings. I have not thought about enabling it in main.cf. But I suppose I can not, since not all users may want greylisting, and at least one user is adamant mails must arrive without any delay.
    Postgrey is running:
    Code:
    systemctl status postgrey.service
    ● postgrey.service - LSB: Start/stop the postgrey daemon
       Loaded: loaded (/etc/init.d/postgrey; generated; vendor preset: enabled)
       Active: active (running) since Thu 2019-07-25 18:59:32 EEST; 4 days ago
         Docs: man:systemd-sysv-generator(8)
      Process: 1001 ExecStart=/etc/init.d/postgrey start (code=exited, status=0/SUCCESS)
        Tasks: 1 (limit: 4915)
       CGroup: /system.slice/postgrey.service
               └─1156 postgrey --pidfile=/var/run/postgrey.pid --daemonize --inet=10023
    
    heinä 30 13:11:55 ispc6 postgrey[1156]: action=pass, reason=triplet found, client_name=newsletters.bigocode.info, client_address=167.99.66.61, [email protected]
    heinä 30 13:11:55 ispc6 postgrey[1156]: cleaning up old logs...
    heinä 30 13:23:54 ispc6 postgrey[1156]: action=pass, reason=client whitelist, client_name=mail-oln040092067095.outbound.protection.outlook.com, client_address=
    heinä 30 13:31:28 ispc6 postgrey[1156]: action=pass, reason=client AWL, client_name=sypressi2.dnainternet.net, client_address=83.102.40.154, sender=bounce30825
    Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
    
     
  7. MaxT

    MaxT Member HowtoForge Supporter

    hi Taleman,

    Have you solved this issue with greylisting?

    I had exactly that same message because one user set two @gmail.com addressess inside the "Copy " option of his ISCP panel.

    The problem was an high number of Facebook notifications ([email protected]) going to these 2 Gmail accounts. And Gmail servers blocked them with that message. It seems they block the forwarded facebook notifications

    To avoid the blacklist I was forced to put the domain "facebookmail.com DISCARD" inside /etc/postfix/sender_access , and to inform the user.

    If you have another solution it would be good to know it.


    thanks
     
  8. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    We are solving different problems.
    My problem was graylisting was not working. I got it working fixing my postfix/main.cf
    Before that my server was on blacklist, but I just wait until it gets removed.
    I know no other way than preventing uses from forwarding their e-mails to other mail systems to prevent ending up in some blacklist since all mailboxes receive so much spam.
     
    MaxT likes this.
  9. MaxT

    MaxT Member HowtoForge Supporter

    oh.. ok. I understand :)
     

Share This Page