You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by DEMBLANS Mathieu <de...@mipih.fr> on 2025/04/16 08:18:56 UTC
disable spamhaus request
Hello everyone,
I try to disable the dnsbl request done to spamhaus.org but the solutions I found doesn't work.
I put
score RCVD_IN_ZEN_BLOCKED_OPENDNS 0
score RCVD_IN_ZEN_BLOCKED 0
score __RCVD_IN_ZEN 0
in local.cf but spamassassin still do dns request to spamhaus.
Doing the same with spamcop (score RCVD_IN_BL_SPAMCOP_NET 0) works correctly.
I forgot something or there is a bug ?
Thanks for your help
Mat
Re: disable spamhaus request
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 2025-04-16 at 05:00:37 UTC-0400 (Wed, 16 Apr 2025 11:00:37 +0200)
Axb <ax...@gmail.com>
is rumored to have said:
> On 16.04.2025 10:18, DEMBLANS Mathieu wrote:
>> Hello everyone,
>> I try to disable the dnsbl request done to spamhaus.org but the
>> solutions I found doesn't work.
>> I put
>> score RCVD_IN_ZEN_BLOCKED_OPENDNS 0
>> score RCVD_IN_ZEN_BLOCKED 0
>> score __RCVD_IN_ZEN 0
>>
>> in local.cf but spamassassin still do dns request to spamhaus.
>>
>> Doing the same with spamcop (score RCVD_IN_BL_SPAMCOP_NET 0) works
>> correctly.
>>
>> I forgot something or there is a bug ?
>> Thanks for your help
>>
>> Mat
>
> that rule is telling youu your queries are being blocked.. nothing
> else. Disabling it won't change the status.
>
> look at "dns_query_restriction" in the documentation
Also note that there are more Spamhaus-related rules, so you would need
to zero out all of their scores to disable them that way. Using
dns_query_restriction is much cleaner.
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo@toad.social and many *@billmail.scconsult.com
addresses)
Not Currently Available For Hire
Re: disable spamhaus request
Posted by Axb <ax...@gmail.com>.
On 16.04.2025 10:18, DEMBLANS Mathieu wrote:
> Hello everyone,
> I try to disable the dnsbl request done to spamhaus.org but the solutions I found doesn't work.
> I put
> score RCVD_IN_ZEN_BLOCKED_OPENDNS 0
> score RCVD_IN_ZEN_BLOCKED 0
> score __RCVD_IN_ZEN 0
>
> in local.cf but spamassassin still do dns request to spamhaus.
>
> Doing the same with spamcop (score RCVD_IN_BL_SPAMCOP_NET 0) works correctly.
>
> I forgot something or there is a bug ?
> Thanks for your help
>
> Mat
that rule is telling youu your queries are being blocked.. nothing else.
Disabling it won't change the status.
look at "dns_query_restriction" in the documentation
Re: disable spamhaus request
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 17.04.25 15:47, DEMBLANS Mathieu wrote:
>Thanks for the link, I will study that.
>Our local nameserver DOESN’T USE shared/open nameservers, it transmit to the good nameservers (for spamhaus, their NS).
do you mean that your nameservers do iterative resolution or you have
configured forwarding on them?
>Why being so aggressive in your response ?
>You probably have a incredibly knowledge you have since you’re born, but I’m not, sorry.
>Instead of that have constructive responses.
>
>Clear informations are sometimes hard to find.
>If you don’t wan to help, don’t respond.
- If you are getting RCVD_IN_ZEN_BLOCKED_OPENDNS, it's possible that your
queries are somehow forwarded through open nameservers.
- there are still URIBL_ZEN_BLOCKED rules that need to be blocked.
use dns_query_restriction to disable access to spamhaus completely.
>Am 16.04.25 um 10:18 schrieb DEMBLANS Mathieu:
>Hello everyone,
>
>I try to disable the dnsbl request done to spamhaus.org but the
>solutions I found doesn’t work.
>
>I put
>
>score RCVD_IN_ZEN_BLOCKED_OPENDNS 0
>
>score RCVD_IN_ZEN_BLOCKED 0
>
>score __RCVD_IN_ZEN 0
>
>in local.cf but spamassassin still do dns request to spamhaus.
>
>Doing the same with spamcop (score RCVD_IN_BL_SPAMCOP_NET 0) works
>correctly.
>
>I forgot something or there is a bug ?
>
>Thanks for your help
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Save the whales. Collect the whole set.
Re: disable spamhaus request
Posted by Bill Cole <bi...@apache.org>.
On 2025-04-17 at 23:30:07 UTC-0400 (Fri, 18 Apr 2025 05:30:07 +0200)
Benny Pedersen via users <me...@junc.eu>
is rumored to have said:
> Andrew C Aitchison skrev den 2025-04-17 22:40:
>
>> I'll just repeat the words that Bill Cole sent last week
>> ( https://marc.info/?l=spamassassin-users&m=174413206312855&w=2 ):
>>
>> Please note that "Reindl Harald <h....@thelounge.net>" has a bad habit
>> of writing pointlessly confrontational, intentionally rude, and very often
>> factually false replies to people posting here. That is why you will not
>> find his posts actually allowed on the list (and on some other lists as
>> well.)
>
> and that sa user list somewhere allow it to be forwarded from anoter sa users acceess to the maillist, hmm :=)
There's no way to prevent forwarding, and this list is archived in places that offer the ability to reply to email in the archived lists. There's no problem with ANYONE reading this list, the reason h.reindl cannot subscribe is because that gives posting rights, which he long ago gave up by his consistently and persistently hostile and aggressive messages.
> we could kill the cat somewhere, or see the rats continue, luckly Canada and Greenland and Denmark is still red and white in ther flags
I sometimes really wish I could interpret your meanings...
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
Re: disable spamhaus request
Posted by Benny Pedersen via users <us...@spamassassin.apache.org>.
Andrew C Aitchison skrev den 2025-04-17 22:40:
> I'll just repeat the words that Bill Cole sent last week
> ( https://marc.info/?l=spamassassin-users&m=174413206312855&w=2 ):
>
> Please note that "Reindl Harald <h....@thelounge.net>" has a bad
> habit
> of writing pointlessly confrontational, intentionally rude, and very
> often
> factually false replies to people posting here. That is why you will
> not
> find his posts actually allowed on the list (and on some other lists as
> well.)
and that sa user list somewhere allow it to be forwarded from anoter sa
users acceess to the maillist, hmm :=)
we could kill the cat somewhere, or see the rats continue, luckly Canada
and Greenland and Denmark is still red and white in ther flags
RE: disable spamhaus request
Posted by DEMBLANS Mathieu <de...@mipih.fr>.
To be more precise, we did'nt receive blocking response "127.255.255.[1..255]" from spamhaus DNS servers but a mail from them to our postmaster address which warn us that we do too much DNS requests from our IP address, not respecting the free usage policy and to use (and pay) for DQS.
So I tryed to decrease the number of requests by tuning our configuration and eliminate requests that are not usefull (I found that our system do several times the same request that is not necessary).
I modify our local DNS to keep cache some more times too.
With this modifications I can decrease the number of requests (divided by 2 at least).
I will see at the end if we can respect the 100000 requests by day.
-----Message d'origine-----
De : Bowie Bailey <Bo...@BUC.com>
Envoyé : vendredi 18 avril 2025 15:40
À : users@spamassassin.apache.org
Objet : Re: disable spamhaus request
On 4/17/2025 4:40 PM, Andrew C Aitchison wrote:
> On Thu, 17 Apr 2025, DEMBLANS Mathieu wrote:
>
>> Thanks for the link, I will study that.
>> Our local nameserver DOESN’T USE shared/open nameservers, it transmit
>> to the good nameservers (for spamhaus, their NS).
>>
>> Why being so aggressive in your response ?
>> You probably have a incredibly knowledge you have since you’re born,
>> but I’m not, sorry.
>> Instead of that have constructive responses.
>>
>> Clear informations are sometimes hard to find.
>> If you don’t wan to help, don’t respond.
>
> I'll just repeat the words that Bill Cole sent last week (
> https://marc.info/?l=spamassassin-users&m=174413206312855&w=2 ):
>
> Please note that "Reindl Harald <h....@thelounge.net>" has a bad
> habit of writing pointlessly confrontational, intentionally rude, and
> very often factually false replies to people posting here. That is why
> you will not find his posts actually allowed on the list (and on some
> other lists as
> well.)
With that being said, he was not incorrect in this instance.
The response received from Spamhaus indicates that you were blocked due to using a public DNS server.
describe RCVD_IN_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/
You should double-check your nameserver setup and make sure it is doing what you think it is doing. Also double-check that the system running SA is actually configured to use your local nameserver (in /etc/resolv.conf or similar) and check for a dns_server setting in the SA config files that might be pointing somewhere else.
--
Bowie
Re: disable spamhaus request
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 2025-04-18 at 11:00:42 UTC-0400 (Fri, 18 Apr 2025 11:00:42 -0400)
pgnd <pg...@dev-mail.net>
is rumored to have said:
>> whether Spamhaus actively looks for open resolvers to block.
>
> fyi,
>
> https://check.spamhaus.org/returnc/pub#want-more-technical-details-
That doesn't really answer whether they are actively *looking for* open resolvers or if they are simply looking at high-volume resolvers and then determining them to be open (which is a trivial test.) In other words, it MAY be possible for people to use small open resolvers that no one is aware of being open and therefore do not generate significant traffic.
OTOH, they COULD be trying a resolution of their own data through every resolver that contacts them. That would tell them whether the resolver is open, which could trigger a block.
--
Bill Cole
Re: disable spamhaus request
Posted by pgnd <pg...@dev-mail.net>.
> whether Spamhaus actively looks for open resolvers to block.
fyi,
https://check.spamhaus.org/returnc/pub#want-more-technical-details-
Re: disable spamhaus request
Posted by Bill Cole <bi...@apache.org>.
On 2025-04-18 at 09:40:29 UTC-0400 (Fri, 18 Apr 2025 09:40:29 -0400)
Bowie Bailey <Bo...@BUC.com>
is rumored to have said:
[...]
> With that being said, he was not incorrect in this instance.
>
> The response received from Spamhaus indicates that you were blocked due to using a public DNS server.
>
> describe RCVD_IN_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/
>
> You should double-check your nameserver setup and make sure it is doing what you think it is doing. Also double-check that the system running SA is actually configured to use your local nameserver (in /etc/resolv.conf or similar) and check for a dns_server setting in the SA config files that might be pointing somewhere else.
It may be useful to note that in principle, Spamhaus blocks *open* resolvers, not just the behemoth resolver farms operated by Google, CloudFlare and others. Some years ago such resolvers were problematic due to amplification attacks, to the point where people operated nag-bots scolding operators for their open resolvers. It is possible for anyone operating a resolver to
accidentally leave it open.
I do not KNOW whether Spamhaus actively looks for open resolvers to block. I would if I were in their place, but I'm not.
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
Re: disable spamhaus request
Posted by Bowie Bailey <Bo...@BUC.com>.
On 4/17/2025 4:40 PM, Andrew C Aitchison wrote:
> On Thu, 17 Apr 2025, DEMBLANS Mathieu wrote:
>
>> Thanks for the link, I will study that.
>> Our local nameserver DOESN’T USE shared/open nameservers, it transmit
>> to the good nameservers (for spamhaus, their NS).
>>
>> Why being so aggressive in your response ?
>> You probably have a incredibly knowledge you have since you’re born,
>> but I’m not, sorry.
>> Instead of that have constructive responses.
>>
>> Clear informations are sometimes hard to find.
>> If you don’t wan to help, don’t respond.
>
> I'll just repeat the words that Bill Cole sent last week
> ( https://marc.info/?l=spamassassin-users&m=174413206312855&w=2 ):
>
> Please note that "Reindl Harald <h....@thelounge.net>" has a bad habit
> of writing pointlessly confrontational, intentionally rude, and very
> often
> factually false replies to people posting here. That is why you will not
> find his posts actually allowed on the list (and on some other lists as
> well.)
With that being said, he was not incorrect in this instance.
The response received from Spamhaus indicates that you were blocked due
to using a public DNS server.
describe RCVD_IN_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
zen.spamhaus.org was blocked due to usage of an open resolver. See
https://www.spamhaus.org/returnc/pub/
You should double-check your nameserver setup and make sure it is doing
what you think it is doing. Also double-check that the system running
SA is actually configured to use your local nameserver (in
/etc/resolv.conf or similar) and check for a dns_server setting in the
SA config files that might be pointing somewhere else.
--
Bowie
RE: disable spamhaus request
Posted by Andrew C Aitchison <sp...@aitchison.me.uk>.
On Thu, 17 Apr 2025, DEMBLANS Mathieu wrote:
> Thanks for the link, I will study that.
> Our local nameserver DOESN’T USE shared/open nameservers, it transmit to the good nameservers (for spamhaus, their NS).
>
> Why being so aggressive in your response ?
> You probably have a incredibly knowledge you have since you’re born, but I’m not, sorry.
> Instead of that have constructive responses.
>
> Clear informations are sometimes hard to find.
> If you don’t wan to help, don’t respond.
I'll just repeat the words that Bill Cole sent last week
( https://marc.info/?l=spamassassin-users&m=174413206312855&w=2 ):
Please note that "Reindl Harald <h....@thelounge.net>" has a bad habit
of writing pointlessly confrontational, intentionally rude, and very often
factually false replies to people posting here. That is why you will not
find his posts actually allowed on the list (and on some other lists as
well.)
--
Andrew C. Aitchison Kendal, UK
andrew@aitchison.me.uk
RE: disable spamhaus request
Posted by DEMBLANS Mathieu <de...@mipih.fr>.
Thanks for the link, I will study that.
Our local nameserver DOESN’T USE shared/open nameservers, it transmit to the good nameservers (for spamhaus, their NS).
Why being so aggressive in your response ?
You probably have a incredibly knowledge you have since you’re born, but I’m not, sorry.
Instead of that have constructive responses.
Clear informations are sometimes hard to find.
If you don’t wan to help, don’t respond.
De : Reindl Harald <h....@thelounge.net>
Envoyé : jeudi 17 avril 2025 17:16
À : DEMBLANS Mathieu <de...@mipih.fr>
Objet : Re: disable spamhaus request
and frankly: when you outright block based on spamhaus common sense
should have told you a flood of RCVD_IN_ZEN_BLOCKED_OPENDNS in
SA also has an impact on your postscreen
RCVD_IN_ZEN_BLOCKED_OPENDNS is *clear* https://www.hmailserver.com/forum/viewtopic.php?t=40286
your nameserver don't do recursion - it fowards query to open nameservers like Google or Cloudflare
you MUST NOT USE shared nameservers on a mailserver
no matter if it's directly or your own nameserver forwards
anybody not kknowing this should refrain from operate mailservers
Am 17.04.25 um 17:03 schrieb Reindl Harald:
Am 17.04.25 um 16:48 schrieb DEMBLANS Mathieu:
"so we will do less DNS requests to spamhaus servers" is nonsense when you have a LOCAL RECURSIVE CACHING NAMESEVER which you don't seems to have
we do some dns caching but I'm not sure it work as expected. I have to take a look on it.
what is "some"?
jesus you need a caching unbound-dns which do recusrion and not ask other
shared nameservers and make sure it caches some time
cache-min-ttl: 60
cache-max-negative-ttl: 60
"is also nonsense because when your postscreen didn't reject because the score wasn't high enough the points of ALL DNSBL contribute to the SA score"
I configure postscreen without a *weight (postscreen_dnsbl_sites = zen.spamhaus.org=127.0.0.[2..11], like explained in spamhaus documentation) so if I read well the doc, if the IP address match the spamhaus list, the smtp request is rejected.
But maybe I doesn't understand well all this mecanism.
Or too confident in spamhaus list.
outright blocking because of a single DNSBl is dumb
" with RCVD_IN_ZEN_BLOCKED_OPENDNS your postfix also don't work as expected but it don't tell you"
sorry I'm not sure to understand. You mean I will not be warned if spamhaus respond with 127.255.255.x for blocking reason if I only use postscreen, right?
why should postscreen warn you?
postscreen has no understanding of return-codes, it only does what you told him
you told him which responds should be used to block mail, not more and not less
your whole idiotic setup don't work at all because the only thing you
rely on (spamhaus) don't work in your setup and instead undestand and
fix the problem you disabled the only part on your setup which
told you about a MAJOR PROBLEM
-----Message d'origine-----
De : Reindl Harald <h....@thelounge.net>
Envoyé : jeudi 17 avril 2025 16:06
À : DEMBLANS Mathieu <de...@mipih.fr>
Objet : Re: disable spamhaus request
Am 17.04.25 um 16:01 schrieb DEMBLANS Mathieu:
We are an enterprise and use several DNS for our internal use.
But that's not the subject.
My original problem is that we use DNSBL on postfix side so we doesn't need it on spamassassin side.
And so we will do less DNS requests to spamhaus servers.
"so we will do less DNS requests to spamhaus servers" is nonsense when you have a LOCAL RECURSIVE CACHING NAMESEVER which you don't seems to have
"so we doesn't need it on spamassassin side" is also nonsense because when your postscreen didn't reject because the score wasn't high enough the points of ALL DNSBL contribute to the SA score
with RCVD_IN_ZEN_BLOCKED_OPENDNS your postfix also don't work as expected but it don't tell you
And I googled some search to find information but didn't find any interesting.
If you have some, please share.
-----Message d'origine-----
De : Reindl Harald <h....@thelounge.net> Envoyé : mercredi 16 avril
2025 23:35 À : DEMBLANS Mathieu <de...@mipih.fr>;
users@spamassassin.apache.org<ma...@spamassassin.apache.org> Objet : Re: disable spamhaus request
Am 16.04.25 um 10:18 schrieb DEMBLANS Mathieu:
Hello everyone,
I try to disable the dnsbl request done to spamhaus.org but the
solutions I found doesn’t work.
I put
score RCVD_IN_ZEN_BLOCKED_OPENDNS 0
score RCVD_IN_ZEN_BLOCKED 0
score __RCVD_IN_ZEN 0
in local.cf but spamassassin still do dns request to spamhaus.
Doing the same with spamcop (score RCVD_IN_BL_SPAMCOP_NET 0) works
correctly.
I forgot something or there is a bug ?
Thanks for your help
why do you use a shared DNS and don't google what RCVD_IN_ZEN_BLOCKED_OPENDNS means?