Problem with RBL

[electricart]

Hi all,

We've encountered a strange problem where all of a sudden, all mail to our Mailserv mail server gets rejected with an error saying that the sending server is blocked by Spamhaus;

 nos...@electricart.com.au
   SMTP error from remote mail server after RCPT TO:<nos...@electricart.com.au>:
   host mail.electricart.com.au [14.203.120.254]:
   554 5.7.1 Service unavailable; Client host [103.9.168.193] blocked using zen.spamhaus.org; bio=37f522a29a97cca660fe1dfce14b63d3a540afa6

This happens from multiple sending servers, including Gmail. All our clients have the same problem.

I tried editing

vi /etc/mail/spamassassin/local.cf

and setting

skip_rbl_checks         0

to

skip_rbl_checks         1

as per

https://wiki.apache.org/spamassassin/DnsBlocklists

However it still rejects mail with the same error. We need to try and fix this ASAP. Anyone have any ideas? Is there some kind of local cached database for the RBL that I need to clear perhaps?

Any help on this matter would be greatly appreciated!

thanks,
Tristan.

[David Gnojek]

Hi Tristan,

do you have still this issue? this looks like your server was blacklisted that time.

did you check if mails really touched your server and mailserv rejected it? (should be in this log:  /var/log/maillog)

 basically you can try to comment this row for a test to get rid of spamhaus: 
 reject_rbl_client zen.spamhaus.org  in  /etc/postfix/main.cf 
 and restart mailserv:  god restart mailserv

Cheers

David

--
You received this message because you are subscribed to the Google Groups "mailserv" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mailserv+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[electricart]

Hi David, thanks so much for your reply.

Unfortunately we were only able to fix the issue by commenting out the line you mentioned in /etc/postfix/main.cf. (as I side note, I had already posted about this, but for some reason my post was deleted?)

Our outgoing mail was unaffected - it was all mail that was being sent to our mail server that was being rejected, so no-one at our domain was receiving emails as all mail from the outside was being blocked.

The mails were definitely hitting our mailserver - there were many lines in /var/log/maillog detailing the incoming emails and subsequent rejections - all claiming rejection because of spamhaus. I visited the spamhaus website and checked all the offending mail servers indicated in our /var/log/maillog. Spamhaus indicated it was NOT blocking any of those servers.

Our server wasn't blacklisted by spamhaus either.

At this stage I have not put back in the spamhaus check as I fear it will result in all email being rejected again...

Works for now, though I would like to have the spamhaus checks in place. I'll re-introduce it at some point and test again. Hopefully it was just a temporary issue.

kind regards,
Tristan.

[Marcus Bointon]

I ran into this same issue ages ago, and avoided it with the same measure, commenting out the RBLs in main.cf. I found that they were all doing it, not just zen. I never found out what the problem was, but I would like to know!

Marcus

[David Gnojek]

usually I dont delete any post here. thanks for description.

struck me an idea: Spamassasin use a database named Spamcontrol.
The database could be corrupted or some dodgy entry could cause this begaviour

can you pls try to run  mysqlcheck on it.

  #mysqlcheck -c spamcontrol

if some error will be found try to fix it

  #mysqlcheck -r spamcontrol

lets see

Cheers

David

[electricart]

Hi David,

Apologies for the late reply.

Here are the results;

# mysqlcheck -c spamcontrol
spamcontrol.awl                                    OK
spamcontrol.bayes_expire                           OK
spamcontrol.bayes_global_vars                      OK
spamcontrol.bayes_seen                             OK
spamcontrol.bayes_token                            OK
spamcontrol.bayes_vars                             OK

Just to make sure I tried repairing anyway;

# mysqlcheck -r spamcontrol
spamcontrol.awl
note     : The storage engine for the table doesn't support repair
spamcontrol.bayes_expire
note     : The storage engine for the table doesn't support repair
spamcontrol.bayes_global_vars
note     : The storage engine for the table doesn't support repair
spamcontrol.bayes_seen
note     : The storage engine for the table doesn't support repair
spamcontrol.bayes_token
note     : The storage engine for the table doesn't support repair
spamcontrol.bayes_vars
note     : The storage engine for the table doesn't support repair

Is there a way to safely delete the database and start again?

kind regards,
Tristan.