Dec 29, 2023: iRedMail-1.6.8 has been released.

**OviVan** · 2011-12-30 16:58:57

OviVan
Member
Offline

Registered: 2011-04-20
Posts: 146

Topic: black list

one question about blacklists, are they working properly ?
I am asking because I have blocked the following domain: @yahoo.co.jp as a sender and as a DNS Name ...
but still I received 2 emails from : abohjohn1101@yahoo.co.jp how is this possible when the entire domain is blocked ?

Any idea ?

Thank You
Best regards

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

**OviVan** · 2011-12-30 17:00:25

OviVan
Member
Offline

Registered: 2011-04-20
Posts: 146

Re: black list

it happens also with other domains, the entire domain is blocked but some of the users can still send the emails from
that domain...

**ZhangHuangbin** · 2011-12-31 22:45:47

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 30,788

Re: black list

- May i know how you manage blacklists? with iRedAdmin-Pro?
- Is there any related log in Postfix log file when these spam emails arrived?
- Could you please paste related postfix log and full mail header of certain spam mails to help troubleshoot?

**OviVan** · 2012-01-02 18:19:02

OviVan
Member
Offline

Registered: 2011-04-20
Posts: 146

Re: black list

here it goes:

Postfix log:

Jan  1 18:04:39 mail postfix/smtpd[11354]: connect from unknown[205.188.249.151]
Jan  1 18:04:40 mail postfix/smtpd[11354]: 475D1C17CD: client=unknown[205.188.249.151]
Jan  1 18:04:40 mail postfix/cleanup[11369]: 475D1C17CD: message-id=<8CE96BAFC897381-1058-37D80@webmail-m170.sysops.aol.com>
Jan  1 18:04:40 mail postfix/qmgr[1403]: 475D1C17CD: from=<gspammer@aol.com>, size=1961, nrcpt=1 (queue active)
Jan  1 18:04:42 mail postfix/smtpd[11354]: disconnect from unknown[205.188.249.151]
Jan  1 18:04:45 mail postfix/smtpd[11377]: connect from mail.myemailserver.com[127.0.0.1]
Jan  1 18:04:45 mail postfix/smtpd[11377]: 263A9C1801: client=mail.myemailserver.com[127.0.0.1]
Jan  1 18:04:45 mail postfix/cleanup[11369]: 263A9C1801: message-id=<8CE96BAFC897381-1058-37D80@webmail-m170.sysops.aol.com>
Jan  1 18:04:45 mail postfix/qmgr[1403]: 263A9C1801: from=<gspammer@aol.com>, size=2401, nrcpt=1 (queue active)
Jan  1 18:04:45 mail postfix/smtpd[11377]: disconnect from mail.myemailserver.com[127.0.0.1]
Jan  1 18:04:45 mail amavis[9239]: (09239-08) Passed CLEAN, LOCAL [205.188.249.151] [149.174.10.175] <gspammer@aol.com> -> <my@email-address.com>, Message-ID: <8CE96BAFC897381-1058-37D80@webmail-m170.sysops.aol.com>, mail_id: Q-ob2D-G9Mwo, Hits$
Jan  1 18:04:45 mail postfix/smtp[11374]: 475D1C17CD: to=<my@email-address.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=5.1, delays=0.47/0.02/0.01/4.6, dsn=2.0.0, status=sent (250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 263A$
Jan  1 18:04:45 mail postfix/qmgr[1403]: 475D1C17CD: removed
Jan  1 18:04:45 mail postfix/smtp[11382]: 263A9C1801: to=<my@email-address.com>, relay=10.48.24.15[10.48.24.15]:25, delay=0.25, delays=0.01/0.02/0.01/0.21, dsn=2.6.0, status=sent (250 2.6.0 <8CE96BAFC897381-1058-37D80@webmail-m170.sysops.aol.co$
Jan  1 18:04:45 mail postfix/qmgr[1403]: 263A9C1801: removed
Jan  1 18:05:40 mail postfix/smtpd[11354]: connect from unknown[186.242.78.140]

Mail source: spammer email is: gspammer@aol.com

Received: from localhost (mail.myemailserver.com [127.0.0.1])    by
 mail.myemailserver.com (Postfix) with ESMTP id 263A9C1801    for <my@email-address.com>;
 Sun,  1 Jan 2012 18:04:45 +0100 (CET)
X-Virus-Scanned: amavisd-new at mail.myemailserver.com
Received: from mail.myemailserver.com ([127.0.0.1])    by localhost
 (mail.myemailserver.com [127.0.0.1]) (amavisd-new, port 10024)    with ESMTP id
 Q-ob2D-G9Mwo for <my@email-address.com>;    Sun,  1 Jan 2012 18:04:40 +0100 (CET)
X-Original-Helo: ims-d14.mx.aol.com (iRedMail: http://www.iredmail.org/)
Received: from ims-d14.mx.aol.com (unknown [205.188.249.151])    by
 mail.myemailserver.com (Postfix) with ESMTP id 475D1C17CD    for <my@email-address.com>;
 Sun,  1 Jan 2012 18:04:40 +0100 (CET)
Received: from oms-db02.r1000.mx.aol.com (oms-db02.r1000.mx.aol.com
 [205.188.58.2])    by ims-d14.mx.aol.com (8.14.1/8.14.1) with ESMTP id
 q01GcrbO022586;    Sun, 1 Jan 2012 11:38:55 -0500
Received: from mtaomg-ma06.r1000.mx.aol.com (mtaomg-ma06.r1000.mx.aol.com
 [172.29.41.13])    by oms-db02.r1000.mx.aol.com (AOL Outbound OMS Interface)
 with ESMTP id 244381C000088;    Sun,  1 Jan 2012 11:38:55 -0500 (EST)
Received: from core-mlb001c.r1000.mail.aol.com (core-mlb001.r1000.mail.aol.com
 [172.29.186.143])    by mtaomg-ma06.r1000.mx.aol.com (OMAG/Core Interface) with
 ESMTP id DC30EE000086;    Sun,  1 Jan 2012 11:38:54 -0500 (EST)
To: <maggotdu31@hotmail.fr>, <magj.jenk@virgin.net>,
    <maiden-ice@hotmail.co.uk>, <mail@allpersonals.com>,
    <mail@allroundgraphics.de>, <my@email-address.com>, <mail@amgdance.com>
Content-Transfer-Encoding: quoted-printable
Subject: Re2:
X-MB-Message-Source: WebUI
X-MB-Message-Type: User
MIME-Version: 1.0
From: <gspammer@aol.com>
Content-Type: text/plain; charset="us-ascii"
X-Mailer: AOL Webmail 35138-MOBILE
Received: from 149.174.10.175 by webmail-m170.sysops.aol.com (64.12.78.174)
 with HTTP (WebMailUI); Sun, 01 Jan 2012 11:38:55 -0500
Message-ID: <8CE96BAFC897381-1058-37D80@webmail-m170.sysops.aol.com>
X-Originating-IP: [149.174.10.175]
Date: Sun, 1 Jan 2012 11:38:54 -0500
x-aol-global-disposition: S
X-AOL-SCOLL-SCORE: 0:2:172316304:93952408  
X-AOL-SCOLL-URL_COUNT: 0  
X-AOL-REROUTE: YES 
x-aol-sid: 3039ac1d290d4f008c1e31c7
Return-Path: gspammer@aol.com
X-MS-Exchange-Organization-AuthSource: srv01.lan.local
X-MS-Exchange-Organization-AuthAs: Anonymous

Policy config output postconf -n :

[root@mail ~]# postconf -n
alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
allow_min_user = no
biff = no
bounce_queue_lifetime = 1d
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
delay_warning_time = 0h
disable_vrfy_command = yes
enable_original_recipient = no
home_mailbox = Maildir/
html_directory = no
inet_interfaces = all
inet_protocols = ipv4
mail_owner = postfix
mailbox_command = /usr/libexec/dovecot/deliver
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
maximal_backoff_time = 4000s
maximal_queue_lifetime = 1d
message_size_limit = 15728640
minimal_backoff_time = 300s
mydestination = $myhostname, localhost, localhost.localdomain, localhost.$myhostname
mydomain = myemailserver.com
myhostname = mail.myemailserver.com
mynetworks = 127.0.0.0/8
mynetworks_style = subnet
myorigin = mail.myemailserver.com
newaliases_path = /usr/bin/newaliases.postfix
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions
queue_directory = /var/spool/postfix
queue_run_delay = 300s
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
recipient_bcc_maps = proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_domain.cf, proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_user.cf
recipient_delimiter = +
relay_domains = $mydestination, proxy:mysql:/etc/postfix/mysql/relay_domains.cf
relayhost = mail.myispprovider.com
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sender_bcc_maps = proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_domain.cf, proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_user.cf
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_data_init_timeout = 240s
smtp_data_xfer_timeout = 600s
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_enforce_tls = no
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,permit_sasl_authenticated, check_helo_access pcre:/etc/postfix/helo_access.pcre
smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_policy_service inet:127.0.0.1:10031
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no
smtpd_sasl_local_domain = 
smtpd_sasl_path = ./dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql/sender_login_maps.cf
smtpd_sender_restrictions = permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated
smtpd_tls_CAfile = /etc/pki/tls/certs/iRedMail_CA.pem
smtpd_tls_cert_file = /etc/pki/tls/certs/iRedMail_CA.pem
smtpd_tls_key_file = /etc/pki/tls/private/iRedMail.key
smtpd_tls_loglevel = 0
smtpd_tls_security_level = may
tls_random_source = dev:/dev/urandom
transport_maps = proxy:mysql:/etc/postfix/mysql/transport_maps_user.cf, proxy:mysql:/etc/postfix/mysql/transport_maps_domain.cf
unknown_local_recipient_reject_code = 550
virtual_alias_domains = 
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql/virtual_alias_maps.cf, proxy:mysql:/etc/postfix/mysql/domain_alias_maps.cf, proxy:mysql:/etc/postfix/mysql/catchall_maps.cf, proxy:mysql:/etc/postfix/mysql/domain_alias_catchall_maps.cf
virtual_gid_maps = static:500
virtual_mailbox_base = /var/vmail
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_maps.cf
virtual_minimum_uid = 500
virtual_transport = dovecot
virtual_uid_maps = static:500

Thank You for reply!

Best regards

**ZhangHuangbin** · 2012-01-02 18:38:52

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 30,788

Re: black list

Postfix config looks fine, still no idea why blacklist doesn't work.
But here's another simple way to block mails from AOL or Yahoo! Japan.

You already have this setting in Postfix:

smtpd_helo_restrictions = ..., check_helo_access pcre:/etc/postfix/helo_access.pcre

So we can update /etc/postfix/helo_access.pcre to blacklist mails from AOL or Yahoo! Japan.
Mail source shows the HELO identity of AOL is xxxx.aol.com, so we can reject it with below setting in /etc/postfix/helo_access.pcre (simply append below content to this file):

/aol\.com$/ REJECT

Restarting Postfix is not required, Postfix will detect file change and load it automatically.

For Yahoo! Japan, try to find the rule of its HELO identities, then update /etc/postfix/helo_access.pcre again.

**OviVan** · 2012-01-02 19:05:47

OviVan
Member
Offline

Registered: 2011-04-20
Posts: 146

Re: black list

I see, but I have 2 questions now.

1. can we add this HELO identify via iRedAdmin or we have to add it manually in /etc/postfix/helo_access.pcre ?

2. what about other emails from "aol" there is some users at aol who email with our users, I assume these emails
will not be blocked ?

Thank You very much for helping

**ZhangHuangbin** · 2012-01-02 23:58:45

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 30,788

Re: black list

1: Manually.
2: If so, you cannot do it this way. Use Policyd instead.

Please try monitoring Postfix log file, make sure Policyd is working. You will see some log entries like "greylist=new", etc..
Also, could you please take a screenshot to show us the blacklist page of iRedAdmin-Pro? so that we can know what records you added, to make sure it's correct format.

**OviVan** · 2012-01-03 00:15:44

OviVan
Member
Offline

Registered: 2011-04-20
Posts: 146

Re: black list

1. ok
2. ok

Please see attached screen-shoot image....

Thank You for helping !

**ZhangHuangbin** · 2012-01-03 00:49:28

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 30,788

Re: black list

You forgot to attach screenshots.

**OviVan** · 2012-01-03 00:54:02

OviVan
Member
Offline

Registered: 2011-04-20
Posts: 146

Re: black list

are You sure ? I added a screen-shoot...
tried again and I got this message now:

Warning! The following errors must be corrected before your message can be posted:

You can add only 1 attachments to this post.

which means that image has been already added

Dec 29, 2023: iRedMail-1.6.8 has been released.

black list

Posts: 10

1 Topic by OviVan 2011-12-30 16:58:57 (edited by OviVan 2011-12-30 16:59:14)

Topic: black list

2 Reply by OviVan 2011-12-30 17:00:25

Re: black list

3 Reply by ZhangHuangbin 2011-12-31 22:45:47

Re: black list

4 Reply by OviVan 2012-01-02 18:19:02

Re: black list

5 Reply by ZhangHuangbin 2012-01-02 18:38:52

Re: black list

6 Reply by OviVan 2012-01-02 19:05:47

Re: black list

7 Reply by ZhangHuangbin 2012-01-02 23:58:45

Re: black list

8 Reply by OviVan 2012-01-03 00:15:44

Re: black list

9 Reply by ZhangHuangbin 2012-01-03 00:49:28

Re: black list

10 Reply by OviVan 2012-01-03 00:54:02

Re: black list

Posts: 10