Dynamic IP's blocked using zen.spamhaus.org

Question

Level 1

21 points

Dynamic IP's blocked using zen.spamhaus.org

554 5.7.1 Service unavailable; Client host http://ISP.Dynamic.IP.Here blocked using zen.spamhaus.org

Externally my users Dynamic IP's are on zen's blacklist, and since the IP's are Dynamic there is no point in allowing them.

Authentication is setup - with SMTP SSL set to use and CRAM-MD5 required (the only one checked)
If the IP is not on the list the emails do go through

I originally thought it was an SSL issue, but it doesn't send event with SSL off on the Client machine.

Thanks in advance

MacBook Pro, Mac OS X (10.5.7)

Posted on Jul 3, 2009 12:01 PM

Reply

Answer 1

davidh

Level 4

1,896 points

Jul 3, 2009 1:01 PM in response to Nathan005

You're probably going to have to move beyond any configuration that Server Admin can create for you,
and work in the command-line with Postfix's far greater & more flexible/powerful capabilities.

Start by posting (using the Terminal) the unedited output of:

postconf -n

Reply

Answer 2

Nathan005 Author

Level 1

21 points

Jul 3, 2009 3:30 PM in response to davidh

This is mostly unedited -
I change the FQDN, (server.domain.us & domain.us) that is all

command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
debug peerlevel = 2
enable serveroptions = yes
html_directory = no
inet_interfaces = all
local recipientmaps =
luser_relay = postmaster
mail_owner = _postfix
mailbox sizelimit = 0
mailbox_transport = cyrus
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
maps rbldomains =
message sizelimit = 10485760
mydestination = $myhostname,localhost.$mydomain,localhost,domain.us
mydomain = domain.us
mydomain_fallback = localhost
myhostname = server.domain.us
mynetworks = 127.0.0.0/8,192.168.0.0/16
newaliases_path = /usr/bin/newaliases
queue_directory = /private/var/spool/postfix
readme_directory = /usr/share/doc/postfix
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = _postdrop
smtpd clientrestrictions = permit_mynetworks reject rblclient zen.spamhaus.org permit
smtpd enforcetls = no
smtpd pw_server_securityoptions = cram-md5
smtpd recipientrestrictions = permit sasl_authenticated,permit_mynetworks,reject_unauthdestination,permit
smtpd sasl_authenable = yes
smtpd tls_certfile = /etc/certificates/server.domain.us.crt
smtpd tls_keyfile = /etc/certificates/server.domain.us.key
smtpd use_pwserver = yes
smtpd usetls = yes
unknown local_recipient_rejectcode = 550

Reply

Answer 3

pterobyte

Level 6

11,104 points

Jul 4, 2009 1:54 AM in response to Nathan005

In /etc/postfix/main.cf, change:
smtpd clientrestrictions = permit_mynetworks reject rblclient zen.spamhaus.org permit
to:
smtpd clientrestrictions = permit saslauthenticated permit_mynetworks reject rblclient zen.spamhaus.org permit

Save and issue:
sudo postfix reload

Make sure your clients authenticate to send.

HTH,
Alex

Reply

Answer 4

davidh

Level 4

1,896 points

Jul 4, 2009 6:46 AM in response to pterobyte

Thanks Pterobyte.

That is exactly what I had in mind of course.

And put back SSL, it can cause sending & receiving to be marginally slower but is rather important.
Barring that (and with your setup probably excluding Kerberos), at a bare minimum you want MD5 for your auth option

Reply

Answer 5

Nathan005 Author

Level 1

21 points

Jul 4, 2009 10:31 AM in response to pterobyte

Thank you both...

will test this tonight when I'm on another network

where is the best place to go to learn more postfix, and mail on leopard?

Reply

Answer 6

davidh

Level 4

1,896 points

Jul 4, 2009 11:46 AM in response to Nathan005

For Postfix, the source: http://www.postfix.org

Just be aware that the Apple-supplied postfix might not have been compiled with some of the options discussed at the Postfix site (probably less of an issue with postfix in 10.5/Leopard), but you *do not need* (best not to) try to compile your own version.
There's no need.

Cyrus ? Well, http://cyrusimap.web.cmu.edu/ , google & mailing lists.

Reply