Hello. I saw in logs that some non existent mailbox from client domain hosted on google tries send some mail to existing mailbox in this same domain. Non existent mailbox is used from IP's: 94.102.49.198 149.56.173.68 and both are blacklisted. I need to block these IP addresses in Postfix and also I would like to add more blacklists to Postfix. I saw that Postfix uses zen.spamhaus.org: reject_rbl_client zen.spamhaus.org
In log it looks like ([email protected] doesn't exists on my client who has mail service hosted on google): Nov 16 06:10:50 s1 amavis[29248]: (29248-11) Passed CLEAN {RelayedOutbound}, LOCAL [127.0.0.1] <[email protected]> -> < [email protected]>, Message-ID: < [email protected]>, mail_id: 9IS02YCv7FyA, Hits: -1.901, size: 937, queued_as: 50F1513C675, 1045 ms Nov 16 18:21:43 s1 dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<[email protected]>, method=PLAIN, rip=94.102.49.198, lip=54.38.202.128, session=<rh2TZst6HE5eZjHG> Today I have deployed working spf with hardfail, dkim and dmarc for this domain. MX records points to google. -- *Pozdrawiam / Best Regards* *Piotr Bracha*
