Hello list, I would highly appreciate it if someone advised on the following, please.
I have these settings: postscreen_greet_action = enforce postscreen_dnsbl_action = drop postscreen_dnsbl_threshold = 1 postscreen_dnsbl_sites = zen.spamhaus.org bl.spamcop.net b.barracudacentral.org The IP address of 46.22.210.20 is listed on spamhaus but it goes straight through to smtpd like this anyway: 22:19:13 postfix/postscreen[14390]: CONNECT from [46.22.210.20]:58953 to [1.1.1.1]:25 22:19:13 postfix/dnsblog[14391]: addr 46.22.210.20 listed by domain zen.spamhaus.org as 127.0.0.3 22:19:17 postfix/postscreen[14390]: DNSBL rank 1 for [46.22.210.20]:58953 22:19:17 postfix/postscreen[14390]: DISCONNECT [46.22.210.20]:58953 22:19:18 postfix/postscreen[14390]: CONNECT from [46.22.210.20]:53440 to [1.1.1.1]:25 22:19:22 postfix/postscreen[14390]: PASS NEW [46.22.210.20]:53440 22:19:22 postfix/smtpd[14403]: connect from construct.baladle.us[46.22.210.20] Now apart from the other settings (this is just an extract) I also have spamhaus set in my smtpd like this: smtpd_recipient_restrictions = reject_rbl_client zen.spamhaus.org As I've mentioned before the IP address of 46.22.210.20 is listed on spamhaus but nontheless it has no effect in smtpd either, that is it's not blocked by spamhaus at all and simply goes onward to spf checks and graylisting like this: 22:19:23 postfix/policy-spf[14407]: Policy action=PREPEND Received-SPF: pass (duplicate.jimello.us: 46.22.210.20 is authorized to use '[email protected]' in 'mfrom' identity (mechanism 'a' matched)) receiver=mymail; identity=mailfrom; envelope-from="[email protected]"; helo=duplicate.jimello.us; client-ip=46.22.210.20 22:19:23 postgrey[4355]: action=greylist, reason=new, client_name=construct.baladle.us, client_address=46.22.210.20, [email protected], [email protected] 22:19:23 postfix/smtpd[14403]: NOQUEUE: reject: RCPT from construct.baladle.us[46.22.210.20]: 450 4.2.0 <[email protected]>: Recipient address rejected: This is my graylising.; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<duplicate.jimello.us> 22:19:43 postfix/smtpd[14403]: disconnect from construct.baladle.us[46.22.210.20] Now if reject_unknown_reverse_client_hostname and reject_unknown_client_hostname are set in the incoming spam messages all right then it passes these ones further onwards as well and the only place where I can stop it going straight through all the "protection" is my header_checks with regexp. I would be really grateful is someone could advise me on what am I missing here? Is this a regular behavior? It does not happen all the time though but I noticed it's 50/50. That is despite the fact that IP addresses are listed on RBLs that are referenced in postscreen_dnsbl_sites and smtpd_recipient_restrictions it has no effect and allows these blacklisted IPs to slip through all the "protection" in 50 % of all the cases, the other half reaches my regexp in header_checks where it finally "dies". First, trying to shoot randomly in the dark I looked at the timing of connections and tried to adjust the smtpd_clients_connection_rate_limit keeping the anvil_rate_time_unit at its default but it didn't help much... Many thanks in advance for any comments / help / assistance at all! -- View this message in context: http://postfix.1071664.n5.nabble.com/postsceen-and-smtpd-recipients-restrictions-tp89110.html Sent from the Postfix Users mailing list archive at Nabble.com.
