OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Is Postfix Checking Spamhaus RBL

From: Ralf Hildebrandt (Ralf.Hildebrandtcharite.de)
Date: Fri Oct 22 2010 - 14:48:06 CDT


* Carlos Mennens <carloswillgmail.com>:

> > Ah, maybe they're looking at all the headers, which is really stupid!
>
> Oh so then this is completely something configured wrong on their end
> using Microsoft Exchange, right?

I seriously doubt that exchange can do this. But I guess the error
must be someplace on their end.

You can reproduce it easily:

* send a mail there. When the mail is being blocked, stay connected.
* now change your Postfix to REMOVE the OFFENDING HEADER with the
  problematic IP from the mail:
  
  header_checks = pcre:/etc/postfix/header_checks
  
  with
  
  /the.ip.which.triggers.the.check/ IGNORE

* postfix reload
* send another mail, from the same ip! (that's why I said: stay connected)

> I just sent email from the same IP to my personal and friends Postfix
> mail servers who both use RBL checks to zen.spamhaus.org and they
> passed through fine.

So do we.

> Can I ask what the normal procedure is for mail? If the latter IP is
> listed on a PBL but the last received IP is not, does it then allow?
> Does Postfix only look at the the most recent received client IP for
> RBL checks and thats all?

Of course. Everything else cannot be trusted anyway.

--
Ralf Hildebrandt
  Geschäftsbereich IT | Abteilung Netzwerk
  CharitĂ© - Universitätsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
  ralf.hildebrandtcharite.de | http://www.charite.de