Managing RBLs in Mailscaner (Spamhaus open resolver no longer working with AWS)

[overscore]

Hi All,

I need help updating the RBL List that Mailscanner checks.
I've updated spam.lists.conf but it does not appear to work as I am still getting an open resolver error from Spamhaus.
(I am not doing any RBL checks in Exim - All of them are off and the custom list is empty)

What am I missing?

For context:
If anyone else is running Mailscanner on an AWS EC2 Instance you may have noticed that emails from senders may be bouncing because Spamhaus is now throwing an error for any lookups from AWS DNS servers. Announcement from spamhaus: https://www.spamhaus.com/resource-cente ... y-service/

The error you'll see in Mailcontrol:
URIBL_ZEN_BLOCKED_OPENDNS 0.00 ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/

From /usr/mailscanner/etc/spam.lists.conf :
pamhaus.org xxxxxxxxxxxxxxxxxxxxxxxxxx.sbl.dq.spamhaus.net
spamhaus-XBL xxxxxxxxxxxxxxxxxxxxxxxxxx.xbl.dq.spamhaus.net
spamhaus-PBL xxxxxxxxxxxxxxxxxxxxxxxxxx.pbl.dq.spamhaus.net
spamhaus-ZEN xxxxxxxxxxxxxxxxxxxxxxxxxx.zen.dq.spamhaus.net
SBL+XBL xxxxxxxxxxxxxxxxxxxxxxxxxx.sbl-xbl.dq.spamhaus.net

[Sarah]

Are you getting that error in the "Spam Report" section for an email in MailControl? If so, it is not MailScanner but SpamAssassin that is triggering the error. You'd have to modify the actual SpamAssassin test to fix the error or stop it from checking. The rule should be in the file /var/lib/spamassassin/3.004004/updates_spamassassin_org/25_uribl.cf. Search that file for "URIBL_ZEN_BLOCKED_OPENDNS" and/or URIBL_ZEN_BLOCKED". If you want to try fixing the rule, you should place any "corrected" lines for the rule in /etc/mail/spamassassin/configserver.cf so that it does not get overwritten with any spamassassin rule update. Unfortunately I can't tell you how exactly to fix it. If you just want to make spamassassin ignore that rule, then you can place a couple of lines like this in /etc/mail/spamassassin/configserver.cf:

score URIBL_ZEN_BLOCKED_OPENDNS 0
score URIBL_ZEN_BLOCKED 0

[overscore]

Hi Sarah,

This is somewhat helpful thank you. I'm seeing this message in the "Spam Report (components)" section under Mail Control. It's helpful to know this is coming from Spamassasin. But the Score is 0.00 anyways so therefore it's not a problem?

Does this mean that Spamassasin is querying Spamhaus as per 25_uribl.cf to check for blacklists?

The core of the issues is that our server has been looking up Spamhaus from AWS Open resolver DNS which Spamhaus has recently banned in that it's throwing an error which causes Exim to reject the email on the senders side.

I'm confused because it now looks like there are 3 places for RBL's to be checked.
1. Exim Configuration (Custom RBLs) - I have this ALL turned off here

2. Mailscanner: %etc-dir%/spam.lists.conf names the list with the DNS lookup and "Spam List" field in the configuration indicates which ones to check .e.g. Spamhaus, SORBS etc. (https://share.cleanshot.com/HeCQ9I) - This is EMPTY for me right now

3. Spamassasin?

On (2) above. I would much prefer to manage everything through Mailscanner. What do I need to do to make this happen at a high level?

[Sarah]

This is somewhat helpful thank you. I'm seeing this message in the "Spam Report (components)" section under Mail Control. It's helpful to know this is coming from Spamassasin. But the Score is 0.00 anyways so therefore it's not a problem?

It's still going to do the test unless you add those lines in my last reply.

Does this mean that Spamassasin is querying Spamhaus as per 25_uribl.cf to check for blacklists?

Yes.

The core of the issues is that our server has been looking up Spamhaus from AWS Open resolver DNS which Spamhaus has recently banned in that it's throwing an error which causes Exim to reject the email on the senders side.

I'm confused because it now looks like there are 3 places for RBL's to be checked.
1. Exim Configuration (Custom RBLs) - I have this ALL turned off here

2. Mailscanner: %etc-dir%/spam.lists.conf names the list with the DNS lookup and "Spam List" field in the configuration indicates which ones to check .e.g. Spamhaus, SORBS etc. (https://share.cleanshot.com/HeCQ9I) - This is EMPTY for me right now

3. Spamassasin?

On (2) above. I would much prefer to manage everything through Mailscanner. What do I need to do to make this happen at a high level?

You can't manage the spamassassin tests through MailScanner. You have to modify them as per my earlier post.

Regards,
Sarah

[overscore]

Thank you so much for the help Sarah! You're amazing