* Wietse Venema <wie...@porcupine.org>:
> Ralf Hildebrandt:
> > $ host 197.251.232.190.zen.spamhaus.org
> > 197.251.232.190.zen.spamhaus.org has address 127.0.0.11
> > 197.251.232.190.zen.spamhaus.org has address 127.0.0.4
> >
> > 2*2 = 7?
>
> Surely you have enough logs of your own that you can verify
> that this does not happen.
I'm using
postscreen_dnsbl_sites = secretkey.zen.dq.spamhaus.net, swl.spamhaus.org*-1
postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply
postscreen_dnsbl_threshold = 1
and found
# zfgrep -i "DNSBL rank" /var/log/OLD/*/mail.log.gz | awk '{print $8}' | sort
| uniq -c
604767 1
15 2
2 3
The last line IS a bit freaky, so looking for that:
# zfgrep -i "DNSBL rank 3" /var/log/OLD/*/mail.log.gz
/var/log/OLD/2011-03-03/mail.log.gz:Mar 3 13:08:08 mail
postfix/postscreen[21412]: DNSBL rank 3 for [188.81.123.210]:50826
/var/log/OLD/2011-03-03/mail.log.gz:Mar 3 13:08:08 mail
postfix/postscreen[21412]: DNSBL rank 3 for [188.81.123.210]:50827
# zfgrep "postscreen" /var/log/OLD/2011-03-03/mail.log.gz |fgrep 188.81.123.210
Mar 3 13:08:02 mail postfix/postscreen[21412]: CONNECT from
[188.81.123.210]:49685 to [141.42.202.200]:25
Mar 3 13:08:02 mail postfix/postscreen[21412]: HANGUP after 0 from
[188.81.123.210]:49685 in tests before SMTP handshake
Mar 3 13:08:02 mail postfix/postscreen[21412]: DISCONNECT
[188.81.123.210]:49685
Mar 3 13:08:02 mail postfix/postscreen[21412]: CONNECT from
[188.81.123.210]:49687 to [141.42.202.200]:25
Mar 3 13:08:02 mail postfix/postscreen[21412]: HANGUP after 0 from
[188.81.123.210]:49687 in tests before SMTP handshake
Mar 3 13:08:02 mail postfix/postscreen[21412]: DISCONNECT
[188.81.123.210]:49687
Mar 3 13:08:02 mail postfix/postscreen[21412]: CONNECT from
[188.81.123.210]:50826 to [141.42.202.200]:25
Mar 3 13:08:02 mail postfix/postscreen[21412]: CONNECT from
[188.81.123.210]:50827 to [141.42.202.200]:25
Mar 3 13:08:08 mail postfix/postscreen[21412]: DNSBL rank 3 for
[188.81.123.210]:50826
Mar 3 13:08:08 mail postfix/postscreen[21412]: DNSBL rank 3 for
[188.81.123.210]:50827
Mar 3 13:08:09 mail postfix/postscreen[21412]: NOQUEUE: reject: RCPT from
[188.81.123.210]:50827: 550 5.7.1 Service unavailable; client [188.81.123.210]
blocked using zen.spamhaus.org;
from=<cal...@udufwgkdubwfjcujweihucwdhbcwva.kollaps.in>,
to=<ai.schna...@charite.de>, proto=ESMTP, helo=<device.lan>
Mar 3 13:08:09 mail postfix/postscreen[21412]: NOQUEUE: reject: RCPT from
[188.81.123.210]:50826: 550 5.7.1 Service unavailable; client [188.81.123.210]
blocked using zen.spamhaus.org;
from=<ri...@udufwgkdubwfjcujweihucwdhbcwva.kollaps.in>, to=<ah...@charite.de>,
proto=ESMTP, helo=<device.lan>
Mar 3 13:08:09 mail postfix/postscreen[21412]: HANGUP after 0.35 from
[188.81.123.210]:50827 in tests after SMTP handshake
Mar 3 13:08:09 mail postfix/postscreen[21412]: DISCONNECT
[188.81.123.210]:50827
Mar 3 13:08:09 mail postfix/postscreen[21412]: HANGUP after 0.35 from
[188.81.123.210]:50826 in tests after SMTP handshake
Mar 3 13:08:09 mail postfix/postscreen[21412]: DISCONNECT
[188.81.123.210]:50826
--
Ralf Hildebrandt
Geschäftsbereich IT | Abteilung Netzwerk
Charité - Universitätsmedizin Berlin
Campus Benjamin Franklin
Hindenburgdamm 30 | D-12203 Berlin
Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
ralf.hildebra...@charite.de | http://www.charite.de
