Hi all,
I’ve had Hestia on a Hetzner VM for a while, but I’ve been having some issues with Spamhaus.
I did follow all instructions to get and use a DQS server, and for a while it worked. I left the server alone for a few weeks and now it’s broken again.
It’s worth noting that Hetzner’s Ubuntu images are configured by default as to use Hetzner’s own upstream DNS caching resolver, but (as shown below) I’ve taken all the steps I can to make sure that I’m using my own bind as a local caching nameserver.
/etc/exim4/dnsbl.conf
bl.spamcop.net
[myownkey].zen.dq.spamhaus.net
/etc/spamassassin/local.cf
# ...
dns_server 127.0.0.1
# ...
/etc/systemd/resolved.conf
[Resolve]
DNS=127.0.0.1
(I commented everything else out, including FallbackDNS)
/etc/netplan/50-cloud-init.yaml
network:
# ...
ethernets:
eth0:
addresses:
# ...
dhcp4: true
dhcp4-overrides:
use-dns: false
match:
# ...
nameservers:
addresses:
- 127.0.0.1
(I removed everything else about dns)
/etc/resolv.conf:
nameserver 127.0.0.53
options edns0 trust-ad
search .
There are also no forwarders in any config files in /etc/bind, or any references to external servers.
Bind (and systemd-resolve?) are listening on port 53:
root@luna:~# lsof -Pn -c0 -i:53
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd-r 677 systemd-resolve 14u IPv4 7984 0t0 UDP 127.0.0.53:53
systemd-r 677 systemd-resolve 15u IPv4 7985 0t0 TCP 127.0.0.53:53 (LISTEN)
systemd-r 677 systemd-resolve 16u IPv4 7986 0t0 UDP 127.0.0.54:53
systemd-r 677 systemd-resolve 17u IPv4 7987 0t0 TCP 127.0.0.54:53 (LISTEN)
named 768 bind 28u IPv4 11077 0t0 UDP 127.0.0.1:53
named 768 bind 29u IPv4 11078 0t0 UDP 127.0.0.1:53
named 768 bind 30u IPv4 11079 0t0 TCP 127.0.0.1:53 (LISTEN)
named 768 bind 32u IPv4 11080 0t0 TCP 127.0.0.1:53 (LISTEN)
named 768 bind 34u IPv4 11081 0t0 UDP 157.90....:53
named 768 bind 35u IPv4 11082 0t0 UDP 157.90....53
named 768 bind 36u IPv4 11083 0t0 TCP 157.90....:53 (LISTEN)
named 768 bind 37u IPv4 11084 0t0 TCP 157.90....:53 (LISTEN)
named 768 bind 38u IPv6 11085 0t0 UDP [::1]:53
named 768 bind 39u IPv6 11086 0t0 UDP [::1]:53
named 768 bind 40u IPv6 11087 0t0 TCP [::1]:53 (LISTEN)
named 768 bind 41u IPv6 11088 0t0 TCP [::1]:53 (LISTEN)
named 768 bind 42u IPv6 11089 0t0 UDP [2a01:4f8:...]:53
named 768 bind 43u IPv6 11090 0t0 UDP [2a01:4f8:...]:53
named 768 bind 44u IPv6 11091 0t0 TCP [2a01:4f8:...]:53 (LISTEN)
named 768 bind 45u IPv6 11092 0t0 TCP [2a01:4f8:...]:53 (LISTEN)
named 768 bind 46u IPv6 11093 0t0 UDP [fe80::9400:2ff:fec5:936a]:53
named 768 bind 47u IPv6 11094 0t0 UDP [fe80::9400:2ff:fec5:936a]:53
named 768 bind 48u IPv6 11095 0t0 TCP [fe80::9400:2ff:fec5:936a]:53 (LISTEN)
named 768 bind 49u IPv6 11096 0t0 TCP [fe80::9400:2ff:fec5:936a]:53 (LISTEN)
spamd\x20 1875 root 10u IPv4 53070 0t0 UDP 127.0.0.1:33737->127.0.0.1:53
and systemd seems to confirm:
root@luna:~# resolvectl status
Global
Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub
Current DNS Server: 127.0.0.1
DNS Servers: 127.0.0.1 127.0.0.1
Link 2 (eth0)
Current Scopes: DNS
Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 127.0.0.1
DNS Servers: 127.0.0.1
So it really looks like it should be all done locally, but for some reason it doesn’t:
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
2.0.0.127.zen.spamhaus.org has address 127.255.255.254
and using @sahsanu’s tool from Unable to receive mail / Openresolver confirms that:
root@luna:~# curl -sSL https://7j.gg/chksph2 | bash -s --
Test 01: Error: open resolver; https://check.spamhaus.org/returnc/pub/2a01:4f8:.../
Test 02: Error: open resolver; https://check.spamhaus.org/returnc/pub/2a01:4f8.../
Test 03: Error: open resolver; https://check.spamhaus.org/returnc/pub/2a01:4f8:.../
Test 04: Error: open resolver; https://check.spamhaus.org/returnc/pub/2a01:4f8:.../
Test 05: Error: open resolver; https://check.spamhaus.org/returnc/pub/2a01:4f8:.../
Test 06: Error: open resolver; https://check.spamhaus.org/returnc/pub/2a01:4f8:.../
Test 07: Error: open resolver; https://check.spamhaus.org/returnc/pub/2a01:4f8:.../
Test 08: Error: open resolver; https://check.spamhaus.org/returnc/pub/2a01:4f8:.../
Test 09: Error: open resolver; https://check.spamhaus.org/returnc/pub/2a01:4f8:.../
Test 10: Error: open resolver; https://check.spamhaus.org/returnc/pub/2a01:4f8:.../
Result is bad, Spamhaus is blocking/ignoring your current DNS Resolver 127.0.0.53{}
I even tried using my Hestia server’s DNS from my home connection, and it does not let me use it (so it’s not an open DNS server):
octavarium:~ jollino$ dig @luna.example.com google.com
; <<>> DiG 9.10.6 <<>> @luna.example.com google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 46134
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; OPT=15: 00 12 ("..")
;; QUESTION SECTION:
;google.com. IN A
;; Query time: 44 msec
;; SERVER: 157.90.158.55#53(157.90.158.55)
;; WHEN: Sun Aug 03 17:53:22 CEST 2025
;; MSG SIZE rcvd: 45
I’ve officially run out of ideas, and I’m missing the days when /etc/resolv.conf was the single place to set DNS resolution stuff.
I’m confused because using DQS should allow using an open resolver anyway, but I’ve set my server so it doesn’t even use one. Yet… it’s borked. Any advice would be most welcome. Not that I strictly need Spamhaus (I haven’t tried others but I’m sure I can work something out), I’d really just like to understand what exactly is preventing this from working in the first place.
Thanks in advance!
(I also updated my post a few times to avoid adding more, so it may have changed while you were replying; sorry!)