Using zen.spamhaus.org deletes emails

Community Support Mail
1

Hello, there is such a problem lately, I configured spamassassin to receive all letters as I understand it, but I see in the logs that the letters are still rejected by zen.spamhaus.org, and I do not receive those letters. What can you do about this, how to configure or disable zen.spamhaus.org?

2024-12-08 19:57:24 H=mail-relay4.stoloto.ru [188.124.55.80] X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_128_GCM:128 CV=no F=<[email protected]> rejected RCPT <[email protected]>: Rejected because 188.124.55.80 is in a black list at zen.spamhaus.org
2024-12-08 12:32:08 H=mail-relay4.stoloto.ru [188.124.55.80] X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_128_GCM:128 CV=no F=<[email protected]> rejected RCPT <[email protected]>: Rejected because 188.124.55.80 is in a black list at zen.spamhaus.org
2024-12-08 12:32:08 H=mail-relay4.stoloto.ru [188.124.55.80] X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_128_GCM:128 CV=no F=<[email protected]> rejected RCPT <[email protected]>: Rejected because 188.124.55.80 is in a black list at zen.spamhaus.org
2024-12-08 15:54:49 rejected EHLO from portscanner-fra1-05.prod.cyberresilience.io [46.101.157.195]: syntactically invalid argument(s): (no argument given)
2024-12-08 17:21:25 H=smtpz502s51.ozon.ru [185.73.195.55] X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_128_GCM:128 CV=no F=<[email protected]> rejected RCPT <[email protected]>: Rejected because 185.73.195.55 is in a black list at zen.spamhaus.org
2024-12-08 19:57:24 H=mail-relay4.stoloto.ru [188.124.55.80] X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_128_GCM:128 CV=no F=<[email protected]> rejected RCPT <[email protected]>: Rejected because 188.124.55.80 is in a black list at zen.spamhaus.org

local.cf

###########################################################################
# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
# Only a small subset of options are listed below
#
###########################################################################

#    A 'contact address' users should contact for more info. (replaces
#    _CONTACTADDRESS_ in the report template)
#report_contact [email protected]

#   Add *****SPAM***** to the Subject header of spam e-mails
rewrite_header Subject *****SPAM*****

#   Save spam messages as a message/rfc822 MIME attachment instead of
#   modifying the original message (0: off, 2: use text/plain instead)
report_safe 0

#   Set which networks or hosts are considered 'trusted' by your mail(белый список IP)
#   server (i.e. not spammers)
#trusted_networks 212.17.35.

#   Whitelist specific email addresses
whitelist_from [email protected]

#   Set file-locking method (flock is not safe over NFS, but is faster)
lock_method flock

#   Set the threshold at which a message is considered spam (default: 5.0)
required_score 4.0

#   Use Bayesian classifier (default: 1)
use_bayes 1

#   Bayesian classifier auto-learning (default: 1)
bayes_auto_learn 1

#   Set headers which may provide inappropriate cues to the Bayesian
#   classifier
bayes_ignore_header X-Bogosity
bayes_ignore_header X-Spam-Flag
bayes_ignore_header X-Spam-Status

#   Whether to decode non- UTF-8 and non-ASCII textual parts and recode
#   them to UTF-8 before the text is given over to rules processing.
normalize_charset 1

#   Some shortcircuiting, if the plugin is enabled
ifplugin Mail::SpamAssassin::Plugin::Shortcircuit

#   default: strongly-whitelisted mails are *really* whitelisted now, if the
#   shortcircuiting plugin is active, causing early exit to save CPU load.
#   Uncomment to turn this on
shortcircuit USER_IN_WHITELIST       on
shortcircuit USER_IN_DEF_WHITELIST   on
shortcircuit USER_IN_ALL_SPAM_TO     on
shortcircuit SUBJECT_IN_WHITELIST    on

#   the opposite; blacklisted mails can also save CPU
shortcircuit USER_IN_BLACKLIST       off
shortcircuit USER_IN_BLACKLIST_TO    off
shortcircuit SUBJECT_IN_BLACKLIST    off

#   if you have taken the time to correctly specify your "trusted_networks",
#   this is another good way to save CPU
shortcircuit ALL_TRUSTED             on

#   and a well-trained bayes DB can save running rules, too
shortcircuit BAYES_99                spam
shortcircuit BAYES_00                ham

endif # Mail::SpamAssassin::Plugin::Shortcircuit

DNS

curl -sSL https://7j.gg/chksph2 | bash -s --
Test 01: Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.4
Test 02: Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.4
Test 03: Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.4
Test 04: Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.4
Test 05: Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.4
Test 06: Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.4
Test 07: Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.4
Test 08: Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.4
Test 09: Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.4
Test 10: Listed by XBL, see https://check.spamhaus.org/query/ip/127.0.0.4

Result is good, Spamhaus works fine with your current DNS Resolver 76.76.2.0
2

Hi @bestperson

Spamassassin is not rejecting the mails, Exim is rejecting them and in this case is not because bad config but the ip is really included in the Spamhaus block list.

If you don’t want to use this block list in Exim, edit file /etc/exim4/dnsbl.conf and remove zen.spamhaus.org from the list.

3

Thanks, but then I can teach spamassassin.

1 Like