Fresh HestiaCP 1.9.2 Installation: Incoming emails blocked due to false spamhaus blacklisting of Gmail/iCloud IPs

1

Hi everyone,

I’m encountering an unusual issue with a fresh installation of HestiaCP 1.9.2 where the server can send emails but cannot receive them. Here’s my setup and the issue:

Environment:

  • Clean installation of HestiaCP 1.9.2
  • All DNS records properly configured (A, MX, DMARC, SPF, DKIM)
  • Google Site verification enabled
  • All necessary TCP ports open

Issue: The server is rejecting incoming emails from legitimate services (Gmail, iCloud) with false claims about Spamhaus blacklisting. Here are the relevant log entries (note: logs have been sanitized - email addresses and server FQDN shown are not the actual ones):

2025-02-23 14:21:54 H=mail-vs1-f42.google.com [209.85.217.42] [...] rejected RCPT <[email protected]>: Rejected because 209.85.217.42 is in a black list at zen.spamhaus.org

2025-02-23 15:14:36 H=mr85p00im-hyfv06011401.me.com [17.58.23.191] [...] rejected RCPT <[email protected]>: Rejected because 17.58.23.191 is in a black list at zen.spamhaus.org

Important Note: I’ve verified these IP addresses directly on https://check.spamhaus.org/ and confirmed they are NOT actually blacklisted, making this issue even more perplexing.

Additional Context:

  • This is my third fresh installation in two days
  • Previous attempts included following various configuration fixes from forum posts regarding v1.9.3
  • My production server running v1.8.12 works perfectly fine
  • Due to these issues, I’m hesitant to upgrade my production server until the next release

Has anyone else encountered this issue or knows why HestiaCP is incorrectly flagging legitimate email providers as being on the Spamhaus blacklist?

2

Forgot to add that the above logs have been taken from /var/log/exim4/mainlog.

The /var/log/exim4/rejecting file is also clearly reporting (and confirming) what indicated in the mainlog file.

type or paste code here
3

Or use a different resolver for dns

Nothing to do with Hestia “itself”

1 Like
4

Hi @eris,

Upon using the ZEN Data Query Service key provided by spamhaus.com, I am able now to receive emails.

Thank you very much for your quick follow up!

However as it’s a free service I wonder if I can use this service in production.

5

Read the terms…

If it is really for commercial use it also has an subscription:

1 Like
6

I have this issue on all hestiacp servers. This solve for me:

sed -i "/zen.spamhaus.org/d" /etc/exim4/dnsbl.conf
systemctl restart exim4