Chuck's Blog

Ok, just because I’m getting hit by quite a few Google searchs for this I’ve decided to just do a quick post on what this error message means:

554 service unavailable blocked using zen.spamhaus.org

Is just a fancy way of a server saying they have blocked you from sending email to them due to a listing in Spamhaus. Now, you should not be getting angry at the server owner for this, they only use the blacklist to reduce spam. You should instead check Spamhaus to see why your IP address is included in the blacklist.

One of the most common reasons for your IP being in this blacklist is because it is dynamic. Because most spam origionates from dynamic IP’s Spamhaus’s Zen blacklist has these included in it. The only real ways around this is to change your IP to a static one, route your mail through your ISP’s server, or route your mail through some other server with a static IP.

After noticing a sharp increase in spam attempts (thankfully spamassassin catchs them!) after setting up my MX server on multiple domains I began to search for a simple, effective, and cheap config for postfix to drop them at SMTP level. Now with Exim4 I could run spamassassin at SMTP level, but postfix isn’t really that interested in letting me do that easily. So I went to my ‘ole friend, RBL’s.

So, in order to try them out, add this to your postfix main.cf

default_rbl_reply = $rbl_code Service unavailable; $rbl_class
[$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason}

smtpd_recipient_restrictions =
   permit_mynetworks,
   permit_sasl_authenticated,
   reject_invalid_hostname,
   reject_non_fqdn_sender,
   reject_non_fqdn_recipient,
   reject_unknown_sender_domain,
   reject_unknown_recipient_domain,
   reject_unauth_destination,
#RBL's
   reject_rbl_client zen.spamhaus.org,
   reject_rbl_client cbl.abuseat.org,
   reject_rbl_client bl.spamcop.net,
   permit

This setup allows the networks specified in your main.cf file to relay, as well as SASL authenticated users. If the connected user is neither authenticated or in your mynetworks postfix will run through the basic checks, like is the mail actually addressed to this domain, is the sender from a fully qualified domain name, etc. until it reachs the RBL checks. If it passes these then it’s sent into the queue, else the mail gets denied with a message like this:

554 5.7.1 Service unavailable; Client host [*******] blocked using
zen.spamhaus.org; http://www.spamhaus.org/query/bl?ip=*********;
from=<***@theirdomain.com> to=<***@yourdomain.com>
proto=ESMTP helo=<theirdomain.com>