dnsbl postscreen - not blocking

Hi, Dec 19 13:04:36 mx1 postfix/postscreen[4770]: CONNECT from [209.85.166.196]:52168 to [public-ip]:25 Dec 19 13:04:42 mx1 postfix/dnsblog[4774]: addr 209.85.166.196 listed by domain dnsbl.sorbs.net as 127.0.0.6 Dec 19 13:04:42 mx1 postfix/postscreen[4770]: PASS NEW [209.85.166.196]:52168 Dec 19

RE: dnsbl postscreen - not blocking

Hai, recent.spam.dnsbl.sorbs.net = 127.0.0.6 and you gave it 1 point. whats the postscreen_dnsbl_threshold set at ? I'll bet thats set higher than 1. Greetz, Louis Van: cubew...@googlemail.com [mailto:owner-postfix-us...@postfix.org] Namens Ste

RE: dnsbl postscreen - not blocking

Hi, I don’t know the answer to your question but from this site http://www.sorbs.net/using.shtml it looks like the IP 209.85.166.196 seems to have tripped one of these : new.spam.dnsbl.sorbs.net127.0.0.6 recent.spam.dnsbl.sorbs.net127.0.0.6 old.spam.dnsbl.sorbs.net127.0.0.6

Re: dnsbl postscreen - not blocking

On 19.12.18 14:00, Stefan Bauer wrote: Dec 19 13:04:36 mx1 postfix/postscreen[4770]: CONNECT from [209.85.166.196]:52168 to [public-ip]:25 Dec 19 13:04:42 mx1 postfix/dnsblog[4774]: addr 209.85.166.196 listed by domain dnsbl.sorbs.net as 127.0.0.6 Dec 19 13:04:42 mx1 postfix/postscreen[4770]: PAS

Re: dnsbl postscreen - not blocking

On Wed, 19 Dec 2018 at 14:51, Matus UHLAR - fantomas wrote: > On 19.12.18 14:00, Stefan Bauer wrote: > >Dec 19 13:04:36 mx1 postfix/postscreen[4770]: CONNECT from > >[209.85.166.196]:52168 to [public-ip]:25 > >Dec 19 13:04:42 mx1 postfix/dnsblog[4774]: addr 209.85.166.196 listed by > >domain dnsb

Re: dnsbl postscreen - not blocking

Stefan Bauer: > Hi, > > Dec 19 13:04:36 mx1 postfix/postscreen[4770]: CONNECT from > [209.85.166.196]:52168 to [public-ip]:25 > Dec 19 13:04:42 mx1 postfix/dnsblog[4774]: addr 209.85.166.196 listed by > domain dnsbl.sorbs.net as 127.0.0.6 It took 6s for dnsblog to figure out that the client is li

Re: dnsbl postscreen - not blocking

On Wed, Dec 19, 2018 at 02:58:00PM +, Dominic Raferd wrote: > This might help OP identify any non-default postscreen settings (kudos: > Viktor) - > > LC_ALL=C join --check-order <(postconf -n) <(postconf -d | sed > 's/=/(default:/; s/$/)/')|grep ^postscreen_ Thanks, but may be worth noting t

Sender-Dependent SASL

Hi I'm using Sender-Dependent SASL authentication and sending to sendgrid but afters a few days we have this errors for all clients: Dec 19 14:35:44 UBMSASENDWEB01 postfix/error[16038]: 4631114A2E3: to=, relay=none, delay=579, delays=569/9.3/0/0.06, dsn=4.0.0, status=deferred (delivery temporar

Re: dnsbl postscreen - not blocking

On Wed, Dec 19, 2018 at 02:00:34PM +0100, Stefan Bauer wrote: > Dec 19 13:04:36 mx1 postfix/postscreen[4770]: CONNECT from > [209.85.166.196]:52168 to [public-ip]:25 > Dec 19 13:04:42 mx1 postfix/dnsblog[4774]: addr 209.85.166.196 listed by > domain dnsbl.sorbs.net as 127.0.0.6 > Dec 19 13:04:42 m

Re: Sender-Dependent SASL

Luis Miguel Flores dos Santos: [ Charset ISO-8859-1 converted... ] > Hi I'm using Sender-Dependent SASL authentication and sending to sendgrid but > afters a few days we have this errors for all clients: > > Dec 19 14:35:44 UBMSASENDWEB01 postfix/error[16038]: 4631114A2E3: > to=, relay=none, del

Re: Outbound opportunistic TLS by default?

micah writes: > Viktor Dukhovni writes: > >>> On Dec 6, 2017, at 8:08 PM, micah wrote: >>> >>> Is there any reason why postfix, when compiled with TLS, can simply set >>> the default to 'may'? >> >> This is easy enough to implement, the only complication is >> that the documentation would need

RE: Sender-Dependent SASL

Of course, but whenever I force the message using postqueue -i the message was delivered nicely. Is there a way to see in the log when postfix tries to send to sendgird, which user and pass are called? I think maybe the user are wrong when they try to send in the queue, but when the message is f

Re: Outbound opportunistic TLS by default?

On Wed, Dec 19, 2018 at 12:54:01PM -0500, micah anderson wrote: > >> This is easy enough to implement, the only complication is > >> that the documentation would need to explain the variable > >> default. > >> > >>> If it is compiled without TLS, the default should be 'no'. > >> > >> This is certa

Re: Outbound opportunistic TLS by default?

On Wednesday, December 19, 2018 01:27:42 PM Viktor Dukhovni wrote: > On Wed, Dec 19, 2018 at 12:54:01PM -0500, micah anderson wrote: > > >> This is easy enough to implement, the only complication is > > >> that the documentation would need to explain the variable > > >> default. > > >> > > >>> If

Re: Outbound opportunistic TLS by default?

On Wed, Dec 19, 2018 at 01:51:19PM -0500, Scott Kitterman wrote: > > So the real question is whether there is a non-trivial community > > of users who: > > > > * Have no explit "smtp_tls_security_level" setting in their main.cf > > file. > > > > * Would not mind to see TLS turned on as a

Re: Outbound opportunistic TLS by default?

> On Dec 19, 2018, at 1:51 PM, Scott Kitterman wrote: > > I'm definitely in favor of it being enabled by default, but, in addition to > being busy, I've been trying to work towards less deviation from upstream in > Debian vice more. There is already plenty that is well baked into our > ecosys

Re: dnsbl postscreen - not blocking

the threshold is at default, so 1. but the dns timeout, Wietse mentioned, might be the real cause. gonna check manuals, if this is configurable. Thank you. Am Mittwoch, 19. Dezember 2018 schrieb Viktor Dukhovni < postfix-us...@dukhovni.org>: > On Wed, Dec 19, 2018 at 02:00:34PM +0100, Stefan Bau

Re: Outbound opportunistic TLS by default?

Viktor Dukhovni: > On Wed, Dec 19, 2018 at 01:51:19PM -0500, Scott Kitterman wrote: > > > > So the real question is whether there is a non-trivial community > > > of users who: > > > > > > * Have no explit "smtp_tls_security_level" setting in their main.cf > > > file. > > > > > > * Would

Re: dnsbl postscreen - not blocking

Stefan Bauer: > the threshold is at default, so 1. > > but the dns timeout, Wietse mentioned, might be the real cause. gonna check > manuals, if this is configurable. postscreen will wait for DNS lookup results until the postscreen_greet_wait timer expires. postscreen_greet_wait = ${stress?{

Re: Outbound opportunistic TLS by default?

Viktor Dukhovni writes: > On Wed, Dec 19, 2018 at 01:51:19PM -0500, Scott Kitterman wrote: > >> > So the real question is whether there is a non-trivial community >> > of users who: >> > >> > * Have no explit "smtp_tls_security_level" setting in their main.cf >> > file. >> > >> > * Woul

Re: Outbound opportunistic TLS by default?

Wietse Venema writes: > Viktor Dukhovni: >> On Wed, Dec 19, 2018 at 01:51:19PM -0500, Scott Kitterman wrote: >> >> > > So the real question is whether there is a non-trivial community >> > > of users who: >> > > >> > > * Have no explit "smtp_tls_security_level" setting in their main.cf >> > >

Re: Outbound opportunistic TLS by default?

> On Dec 19, 2018, at 3:34 PM, Wietse Venema wrote: > >> If there are no objections, I can change the default to "may" when >> TLS is compiled in. > > Unrelated but related, what should happen when someone unwittingly > builds Postfix without TLS support, and Postfix configuration a) > enable

Re: Outbound opportunistic TLS by default?

micah anderson: > What happens now when someone builds without TLS support and then > enables some TLS option? It seems like the same thing should happen > here. I don't care what happens now. I want to avoid sending plaintext mail when Postfix is configured to require TLS, and someone forgets to