1

Topic: Mail blacklisted suddenly for local accounts - HELP NEEDED

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
iRedMail     0.9.8
iRedAdmin-Pro     2.9.0 (MySQL)
CentOS
====

Hi after spammassisan update , emails started to be denied with message (i replaced emails with  LOCAL_EMAIL (managed by iredmail) or GMAIL_EMAIL(external) not to show them here):

554 5.7.1 <EMAIL_HERE>: Recipient address rejected: Blacklisted

I found out in /var/log/iredapd/iredapd.log                                                                                                                                                                                   
2018-11-13 11:18:20 INFO [209.85.208.174] RCPT, GMAIL_EMAIL -> LOCAL_EMAIL, REJECT Blacklisted [sasl_username=, sender=GMAIL_EMAIL , client_name=mail-lj1-f174.google.com, reverse_client_name=mail-lj1-f174.goog
le.com, helo=mail-lj1-f174.google.com, encryption_protocol=TLSv1.2, process_time=0.0053s]
2018-11-13 11:18:27 INFO Blacklisted: wblist=(1, 9, 'B')

if i remove "check_policy_service inet:127.0.0.1:7777," from postfix config  some mail would start coming, but gmail is not coming without any bounce.

If i check database wblist table has these :
1    1    B
1    3    B
1    4    W
1    6    W
1    8    B
1    9    B
1    10    B
1    11    B
1    12    B
1    14    B
1    15    B
1    16    B
1    20    B
1    21    W
1    22    W
1    23    B
1    24    B
1    25    B
1    26    B
1    27    B
1    28    B
1    29    B
2    10    W
3    10    W
5    11    W


i have remove thosw with "B" and seems things are better, but im stillnot 100% sure, why this happened and how this blacklist started blocking LOCAL mails ?

Can anywone explain how things are working  here and how this could have happened ?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Mail blacklisted suddenly for local accounts - HELP NEEDED

- iRedMail doesn't have cron job to other tool to AUTOMATICALLY blacklist some senders in "amavisd.wblist" table.
- It's very possible that you or other sysadmin mistakenly blacklisted this sender.

3

Re: Mail blacklisted suddenly for local accounts - HELP NEEDED

HI Zhang,
Thanks for reply. I managed to clean blacklist, however still have ongoing problem .

The mail gets Quarantined even when server global policy is set to NOT QUARANTINE (see image) (inner domains/ personal emails are also switched off for quarantine )

I need however the mail to get the SPAM-X headers ., thus i cannot switch of "Enable Spam Checking" i assume. But i dont need any mail to stuck in quaranitne.

Could you please comment on this ?

Post's attachments

mail_qu.jpg 259.95 kb, file has never been downloaded. 

You don't have the permssions to download the attachments of this post.

4

Re: Mail blacklisted suddenly for local accounts - HELP NEEDED

PS - To my last question - i see that im unable to make "Prefix text [SPAM] to the subject of spam" thing work . I checked it serverwise, i see many mails with score more than 6 , and none of mails got [SPAM] in the subject.

5

Re: Mail blacklisted suddenly for local accounts - HELP NEEDED

Please turn on debug mode in Amavisd to see which spam policy it gets from sql db.
FYI: https://docs.iredmail.org/debug.amavisd.html

6

Re: Mail blacklisted suddenly for local accounts - HELP NEEDED

OK, enabled, lots of information in there. Should i look for something specific ? (I thought of sharing it here- but its a huge file with lots of dbg info )

7

Re: Mail blacklisted suddenly for local accounts - HELP NEEDED

You need to check the SQL query related log, usually it contains string "lookup_sql" (or "sql_lookup"? sorry i cannot remember it at this moment sad )

Try to find out which SQL record it uses.