problems with cbl.abuseat.org

Jeremy Ardley

unread,

Jun 30, 2022, 4:00:06 AM6/30/22

to

I'm using postfix as my MTA and lately I've been missing a significant fraction from my usual mail

e.g. email from linkedin and spamassassin list.

Tracking it down I see they are all getting rejected by abuseat. e.g.

Jun 30 14:20:09 egde postfix/25pass/smtpd[21040]: NOQUEUE: reject: RCPT from mail.openbsd.org[199.185.178.25]: 554 5.7.1 Service unavailable; Client host [199.185.178.25] blocked using cbl.abuseat.org; Error: open resolver; https://www.spamhaus.org/returnc/pub/172.68.1.20; from=<owner-libressl+M1127=jeremy=ardle...@openbsd.org> to=<jer...@ardley.org> proto=ESMTP helo=<mail.openbsd.org>

I've removed that from my postfix filters, but is there a current best practice set of rbl filters?

--
Jeremy

OpenPGP_signature

Claudio Kuenzler

unread,

Aug 3, 2022, 8:00:05 AM8/3/22

to

On Thu, Jun 30, 2022 at 9:55 AM Jeremy Ardley <jer...@ardley.org> wrote:

I'm using postfix as my MTA and lately I've been missing a significant fraction from my usual mail

e.g. email from linkedin and spamassassin list.

Tracking it down I see they are all getting rejected by abuseat. e.g.

Jun 30 14:20:09 egde postfix/25pass/smtpd[21040]: NOQUEUE: reject: RCPT from mail.openbsd.org[199.185.178.25]: 554 5.7.1 Service unavailable; Client host [199.185.178.25] blocked using cbl.abuseat.org; Error: open resolver; https://www.spamhaus.org/returnc/pub/172.68.1.20; from=<owner-libressl+M1127=jeremy=ardle...@openbsd.org> to=<jer...@ardley.org> proto=ESMTP helo=<mail.openbsd.org>

I just ran into this problem as well -> https://twitter.com/ClaudioKuenzler/status/1554559303507492865

Starting yesterday (August 2nd 2022) afternoon, all incoming mails are being rejected due to a "blocked using...". This concerns all DNSBL managed by Spamhaus.

The reason is that Spamhaus stopped serving their DNSBL via public DNS resolvers, such as Cloudflare's 1.1.1.1 or Google's 8.8.8.8 and 8.8.4.4 resolvers.

See: https://www.spamhaus.com/resource-center/if-you-query-spamhaus-projects-dnsbls-via-cloudflares-dns-move-to-the-free-data-query-service/

The solution, according to Spamhaus support, is to register for a free account and use their DQS (Data Query Service).

I just did that this morning and although I was assured this would be a free of charge account, I now received a quote of USD 450 per year.

I guess that was it then with Spamhaus.

cheers,

ck

Jeremy Ardley

unread,

Aug 3, 2022, 8:10:05 AM8/3/22

to

On 3/8/22 7:49 pm, Claudio Kuenzler wrote:
>
>
> I just ran into this problem as well ->
> https://twitter.com/ClaudioKuenzler/status/1554559303507492865
> <https://twitter.com/ClaudioKuenzler/status/1554559303507492865>
> Starting yesterday (August 2nd 2022) afternoon, all incoming mails are
> being rejected due to a "blocked using...". This concerns all DNSBL
> managed by Spamhaus.
> The reason is that Spamhaus stopped serving their DNSBL via public DNS
> resolvers, such as Cloudflare's 1.1.1.1 or Google's 8.8.8.8 and
> 8.8.4.4 resolvers.
> See:
> https://www.spamhaus.com/resource-center/if-you-query-spamhaus-projects-dnsbls-via-cloudflares-dns-move-to-the-free-data-query-service/
> <https://www.spamhaus.com/resource-center/if-you-query-spamhaus-projects-dnsbls-via-cloudflares-dns-move-to-the-free-data-query-service/>
>
> The solution, according to Spamhaus support, is to register for a free
> account and use their DQS (Data Query Service).
> I just did that this morning and although I was assured this would be
> a free of charge account, I now received a quote of USD 450 per year.
> I guess that was it then with Spamhaus.
>
>

After some experimentation I got this setup to work with spamrats on my
mail gateway. spamcop, sorbs, abuseat, and spamhaus caused problems so
were removed from the config

smtpd_recipient_restrictions =
   permit_sasl_authenticated
   permit_mynetworks
   reject_unauth_destination
   reject_invalid_hostname
   reject_non_fqdn_hostname
   reject_non_fqdn_sender
   reject_non_fqdn_recipient
   reject_unknown_sender_domain
   reject_rbl_client noptr.spamrats.com
   reject_rbl_client spam.spamrats.com
   reject_rbl_client dyna.spamrats.com

#   reject_rbl_client bl.spamcop.net
#   reject_rbl_client dnsbl.sorbs.net
#   reject_rbl_client sbl.spamhaus.org
#   reject_rhsbl_helo dbl.spamhaus.org
#   reject_rhsbl_reverse_client dbl.spamhaus.org
#   reject_rhsbl_sender dbl.spamhaus.org
#   reject_rbl_client cbl.abuseat.org

--
Jeremy

OpenPGP_signature