0

Just after we implemented spam filtering on our Postfix server using spamassassin-dqs through amavisd-new we drastically reduced received spam, but to our surprise our own outgoing e-mails are being blocked as well. Our server runs on a AWS EC2 instance, so I suppose our office's ISP IP Block might be on some of Spamhaus blocklists and when spamassassin sees it is comming from there it blocks our own e-mails from being sent.

Is there a way to whitelist our own e-mail senders (they are being authenticated through SASL) so only them are not subjected to spamassassin filtering?

Down here is an example taken from /var/log/mail.log when I just tried to send an e-mail. See an Anonymous TLS connection is stablished to our server, but from "unkonwn" (I supposed a SASL authenticated user would not be 'unknown', but I don't fully understand that...). Any ideas?

Jan 25 19:31:06 helpocorp postfix/submission/smtpd[1954]: Anonymous TLS connection established from unknown[187.20.170.32]: TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
Jan 25 19:31:07 helpocorp postfix/submission/smtpd[1954]: NOQUEUE: reject: RCPT from unknown[187.20.170.32]: 554 5.7.1 Service unavailable; Client host [187.20.170.32] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/187.20.170.32; from=<claudio@helpo.com.br> to=<felix.claudio@gmail.com> proto=ESMTP helo=<[192.168.10.10]>
Jan 25 19:31:07 helpocorp postfix/submission/smtpd[1954]: lost connection after RCPT from unknown[187.20.170.32]
Jan 25 19:31:07 helpocorp postfix/submission/smtpd[1954]: disconnect from unknown[187.20.170.32] ehlo=2 starttls=1 auth=1 mail=1 rcpt=0/1 commands=5/6
Claudio
  • 159
  • 6
  • You can setup different smtpd_*_restrictions on different postfix instances - you clearly have a dedicated line in your master.cf where such settings could be overridden. See the tag description for more info on how to [share your configuration](https://serverfault.com/posts/1121153/edit) in a way an answer can directly address the problem for you. – anx Jan 26 '23 at 01:38
  • Hey @anx, thanks for your feedback, but I guess I just found the problem fussing around. I had placed the reject directives related to querying Spamhaus blocklists right in the start of the `smtpd_client_restrictions` section (before the `permit_sasl_authenticated` directive), so it seems it was kind of quitting before it got there. I changed their ordering and it just worked! Thanks anyway for the tips. – Claudio Jan 26 '23 at 02:58

1 Answers1

0

After much fiddling and reading around I read something somewhere about order being important in smtpd_client_restrictions, so I thought, maybe these "reject" directives related to spamassassin-dqs being in first place were causing the whole checking to quit once it found the IP in the blocking list, so I tried to put permit_sasl_authenticated before those and it just worked!

Claudio
  • 159
  • 6