# Outbound mail to blocked: Spamhaus “open resolver” return code – need help with YunoHost DNS/Rspamd setup
**URL:** https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469
**Category:** Support
**Tags:** english
**Created:** [October 18, 2025, 6:40am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469 "2025-10-18T06:40:14Z")
**Posts on this page:** 20
**Page:** 2
### Author:  [@AT69](https://forum.yunohost.org/u/AT69)
#### Post date: [October 20, 2025, 5:56am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/22 "2025-10-20T05:56:41Z")
I’ve now updated to 12.1.29 as well. Can I reopen ports 53 and 5353, or should I keep them closed? Can I enable ‘blocklists for incoming traffic’ again, or should I leave it disabled? And what about email with the IPv6 setting — should I turn everything back on? Sorry for my questions, but I had done this beforehand.
---
### Author:  [@YouKnowHorst](https://forum.yunohost.org/u/YouKnowHorst)
#### Post date: [October 20, 2025, 6:39am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/23 "2025-10-20T06:39:23Z")
I just can tell you, that I’ve decided to keep the deactivation of the incoming mail blocklist, because I’ve found a lot of false positives while browsing my own mail.log. I well check the log frequently the next weeks to identify possible spam impacts.
For your concrete ports: What application uses these?
---
### Author:  [@jarod5001](https://forum.yunohost.org/u/jarod5001)
#### Post date: [October 20, 2025, 8:25am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/24 "2025-10-20T08:25:28Z")
> [@AT69](#):
>
> ports 53 and 5353
Let them closed unless you are at home, using Adguard home and these ports are closed on your router. They are not meant to be publicly open.
Have a good read :
> [@Why are ports 53 and 5353 opened?](https://forum.yunohost.org/t/why-are-ports-53-and-5353-opened/12770):
>
> My YunoHost server Hardware: computer YunoHost version: 4.0.8 I have access to my server : Through SSH, through the webadmin Are you in a special context or did you perform some particular tweaking on your YunoHost instance ? : yes If yes, please explain: yunohost is running in a VM Description of my issue I noticed that in my yunohost the ports 53 and 5353 are open. Searching online, I found that those ports are usually used for DNS and Multicast DNS respectively. I didn’t see any info a…
> **[What is Port 5353? Uses, Security Risks, and How to Manage It](https://sslinsights.com/what-is-port-5353/)**
>
> Learn about port 5353: its uses, security risks, and management tips. Discover how it impacts networking and best practices for safety.
---
### Author:  [@AT69](https://forum.yunohost.org/u/AT69)
#### Post date: [October 20, 2025, 8:43am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/25 "2025-10-20T08:43:39Z")
Thank you very much for your contribution; I’ll do that as well. 👍
---
### Author:  [@AT69](https://forum.yunohost.org/u/AT69)
#### Post date: [October 20, 2025, 8:46am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/26 "2025-10-20T08:46:11Z")
THANK YOU, I’ll read it carefully, but ports 53 and 5353 will remain closed. Many thanks for your help.
---
### Author:  [@oberger](https://forum.yunohost.org/u/oberger)
#### Post date: [October 20, 2025, 10:05am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/27 "2025-10-20T10:05:36Z")
Hmmm… it seems we still have an issue although we updated YNH to 12.1.29.
Still:
```Service
Client host [XXXX] blocked using cbl.abuseat.org; Error: open
resolver;
https://check.spamhaus.org/returnc/pub/2001:19f0:5000:1800:5400:5ff:fe01:2dc5/
(in reply to RCPT TO command)
```
OK, if I try this:
```host
5.c.d.2.1.0.e.f.f.f.5.0.0.0.4.5.0.0.8.1.0.0.0.5.0.f.9.1.1.0.0.2.ip6.arpa domain name pointer ams1.dns4all.eu.
```
Hmmm… OK, so there’s an issue with something related to: `ams1.dns4all.eu`
Let’s check your commit at: [diagnosis/email/dnsbl: fix infamous issue with spamhaus returning 'op… · YunoHost/yunohost@396e5d3 · GitHub](https://github.com/YunoHost/yunohost/commit/396e5d327ad2de80ae5d746bbe7decac21cdfe1c#diff-7bcaf02b6490472a68b49985c66cff43344a6cac8f10dc0be82920f9902684eaR235-R249) :
Hmmm… this mentions “Use whatever is in /etc/resolv.conf, which in the nominal case will be dnsmasq which itself uses /ec/resolv.dnsmasq.conf etc.” (should be _/etc/resolv.dnsmasq.conf_, btw).
So:
```auto
# cat /etc/resolv.dnsmasq.conf
nameserver 194.150.168.168
nameserver 2a0c:e300::101
nameserver 89.234.141.66
nameserver 185.233.100.101
nameserver 2a0c:e300::100
nameserver 194.0.5.3
nameserver 2a0c:e300::1337
nameserver 2001:1608:10:25::9249:d69b
nameserver 2a00:5881:8100:1000::3
nameserver 185.233.100.100
nameserver 2001:1608:10:25::1c04:b12f
nameserver 84.200.70.40
nameserver 45.67.81.23
nameserver 2001:678:8::3
```
Aha :
```auto
$ host 2001:678:8::3
3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.0.0.8.7.6.0.1.0.0.2.ip6.arpa domain name pointer resolver.dns4all.eu.
```
Hmmm… Am I right there ought to be something else to be done, to fix the issue ? I don’t understand what dnsmasq does here exactly… something standard on a YNH install ? The comment above isn’t really clear to me.
@Aleks Is the diag script in your commit sufficient, or do we have to perform something more after the update to 12.1.29 ?
---
### Author:  [@oberger](https://forum.yunohost.org/u/oberger)
#### Post date: [October 20, 2025, 10:39am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/28 "2025-10-20T10:39:16Z")
I’ve tried removing entries related to dns4all from the /etc/resolv.dnsmasq.conf file, and got:
```auto
--- a/resolv.dnsmasq.conf
+++ b/resolv.dnsmasq.conf
@@ -3,7 +3,6 @@ nameserver 2a0c:e300::101
nameserver 89.234.141.66
nameserver 185.233.100.101
nameserver 2a0c:e300::100
-nameserver 194.0.5.3
nameserver 2a0c:e300::1337
nameserver 2001:1608:10:25::9249:d69b
nameserver 2a00:5881:8100:1000::3
@@ -11,4 +10,3 @@ nameserver 185.233.100.100
nameserver 2001:1608:10:25::1c04:b12f
nameserver 84.200.70.40
nameserver 45.67.81.23
-nameserver 2001:678:8::3
```
and then it seems we no longer have mail issues reported…
But, then the /etc/resolv.dnsmasq.conf file is reported modified in the diags…
But when I’m trying the following it seems I could regenerate it:
```auto
# yunohost tools regen-conf dnsmasq --dry-run --with-diff
Warning: The configuration file '/etc/resolv.dnsmasq.conf' has been manually modified and will not be updated
dnsmasq:
applied:
pending:
/etc/resolv.dnsmasq.conf:
diff: @@ -1,12 +1,14 @@
+nameserver 84.200.70.40
+nameserver 89.234.141.66
+nameserver 2001:1608:10:25::1c04:b12f
+nameserver 2a0c:e300::101
+nameserver 2a00:5881:8100:1000::3
nameserver 194.150.168.168
-nameserver 2a0c:e300::101
-nameserver 89.234.141.66
+nameserver 2001:678:8::3
nameserver 185.233.100.101
+nameserver 185.233.100.100
+nameserver 45.67.81.23
+nameserver 2a0c:e300::1337
nameserver 2a0c:e300::100
-nameserver 2a0c:e300::1337
nameserver 2001:1608:10:25::9249:d69b
-nameserver 2a00:5881:8100:1000::3
-nameserver 185.233.100.100
-nameserver 2001:1608:10:25::1c04:b12f
-nameserver 84.200.70.40
-nameserver 45.67.81.23
+nameserver 194.0.5.3
status: modified
```
However, in the above, if I don’t see 2001:678:8::3 appearing again, it seems that 194.0.5.3 would be restored (resolver.dns4all.eu)…
Is there anything adviceable here ?
---
### Author:  [@oberger](https://forum.yunohost.org/u/oberger)
#### Post date: [October 20, 2025, 10:56am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/29 "2025-10-20T10:56:45Z")
Maybe the proper way to go would be to remove DNS4all entries in `/usr/share/yunohost/conf/dnsmasq/plain/resolv.dnsmasq.con`:
```auto
# diff -Naur /usr/share/yunohost/conf/dnsmasq/plain/resolv.dnsmasq.conf.orig /usr/share/yunohost/conf/dnsmasq/plain/resolv.dnsmasq.conf
--- /usr/share/yunohost/conf/dnsmasq/plain/resolv.dnsmasq.conf.orig 2025-10-20 12:50:12.089230400 +0200
+++ /usr/share/yunohost/conf/dnsmasq/plain/resolv.dnsmasq.conf 2025-10-20 12:50:20.657384672 +0200
@@ -24,6 +24,3 @@
nameserver 2001:1608:10:25::1c04:b12f
nameserver 84.200.70.40
nameserver 2001:1608:10:25::9249:d69b
-# DNS4all
-nameserver 194.0.5.3
-nameserver 2001:678:8::3
```
and `yunohost tools regen-conf dnsmasq -f` ?
---
### Author:  [@AT69](https://forum.yunohost.org/u/AT69)
#### Post date: [October 20, 2025, 11:09am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/30 "2025-10-20T11:09:13Z")
I can only report that since the new YunoHost update I sometimes appear on the spam list and then not again. So the problem doesn’t seem fully resolved. As mentioned, ports 53 and 5353 are closed, IPv6 is off, and the spam list is disabled.
---
### Author:  [@Aleks](https://forum.yunohost.org/u/Aleks)
#### Post date: [October 20, 2025, 1:52pm UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/31 "2025-10-20T13:52:06Z")
> [@oberger](#):
>
> ```auto
> Client host [XXXX] blocked using cbl.abuseat.org; Error: open
> resolver;
>
> ```
Yeah as I was saying in another thread, mayybe we need to apply the same fix to [abuseat.org](http://abuseat.org) CBL that we did for spamhaus x\_x …
> [@oberger](#):
>
> @Aleks Is the diag script in your commit sufficient, or do we have to perform something more after the update to 12.1.29 ?
No there isnt anything to do on your side
> [@oberger](#):
>
> Maybe the proper way to go would be to remove DNS4all entries
Using DNS4all is legit, I don’t think we want to just trash them just because of the ultra-specific case of Spamhaus and CBL DNSBL refusing to answer via this specific resolver …
> [@AT69](#):
>
> As mentioned, ports 53 and 5353 are closed, IPv6 is off, and the spam list is disabled.
Contrarily to what I thought initially, I doubt ports 53/5353 or IPv6 are related to this issue. Just do whatever you want about these … though personally I would tend to not open port 53 / 5353 _unless_ you make sure they are only exposed on your local network
---
### Author:  [@oberger](https://forum.yunohost.org/u/oberger)
#### Post date: [October 20, 2025, 1:55pm UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/32 "2025-10-20T13:55:20Z")
> [@Aleks](#):
>
> Yeah as I was saying in another thread, mayybe we need to apply the same fix to [abuseat.org](http://abuseat.org) CBL that we did for spamhaus x\_x …
Ah, yes, I was mistaken by thinking the complaint was from the same third party, but this isn’t spamhaus, indeed. Good catch.
Thanks for your help
---
### Author:  [@rodinux](https://forum.yunohost.org/u/rodinux)
#### Post date: [October 20, 2025, 2:05pm UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/33 "2025-10-20T14:05:24Z")
Thanks for the fix… I have upgraded yunohost servers and it fixed same issues…
_Ils abuse(nt)_
---
### Author:  [@AT69](https://forum.yunohost.org/u/AT69)
#### Post date: [October 20, 2025, 2:57pm UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/34 "2025-10-20T14:57:26Z")
> [@Aleks](#):
>
> Yeah as I was saying in another thread, mayybe we need to apply the same fix to [abuseat.org](http://abuseat.org) CBL that we did for spamhaus x\_x …
Yes, that’s right—I was on the list too, but the message went away again. In any case, thank you very much for your efforts. A loyal donor.
---
### Author:  [@AT69](https://forum.yunohost.org/u/AT69)
#### Post date: [October 20, 2025, 3:00pm UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/35 "2025-10-20T15:00:53Z")
Thank you for your valuable tips, and I hope my question didn’t cause you too much work—otherwise, I apologize for that.
---
### Author:  [@Sil20](https://forum.yunohost.org/u/Sil20)
#### Post date: [October 21, 2025, 8:09pm UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/36 "2025-10-21T20:09:44Z")
I see that post and I have a different solution. I had resolve this problem with chat GPT :
“If you use `unbound`”
sudo nano /etc/unbound/unbound.conf.d/yunohost.conf
interface: 127.0.0.1
sudo systemctl restart unbound
if you use : dnsmasq
sudo nano /etc/dnsmasq.conf
listen-address=127.0.0.1
sudo systemctl restart dnsmasq
Be carreful I’m a newbie. If I can help… master or admin can test this and fix the issue.
---
### Author:  [@peer](https://forum.yunohost.org/u/peer)
#### Post date: [October 22, 2025, 12:22am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/37 "2025-10-22T00:22:02Z")
Hi @Aleks
or whoever who could explain me… I’m not sure I fully understand what happened.
On the one hand there is this rejection message received by sender which says `Client host [11.11.11.11] blocked using cbl.abuseat.org`. So, what I understand here is that our yunohost server is considering client 11.11.11.11 (which is just a sending server connecting to our receiving yunohost server) as an abuser according to [cbl.abuseat.org](http://cbl.abuseat.org). Is that what the message is saying?
On the other hand, there is your explanation. If I understood correctly there is a problem with some of the DNS server addresses configured at Yunohost that makes Spamhaus or Abuseat or whoever detect queries from an ‘open resolver’ so they decide not to answer them. Then, as Yunohost does not get any answer to their DNS queries asking about the spam status of the sending server, then Yunohost automatically considers it as a possible abuser and rejects the receiving message reporting this half truth (“blocked using [cbl.abuseat.org](http://cbl.abuseat.org)”). Is that what you mean? Is that what is happening?
---
### Author:  [@peer](https://forum.yunohost.org/u/peer)
#### Post date: [October 22, 2025, 12:26am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/38 "2025-10-22T00:26:15Z")
And, by the way, does the update include the fix for [cbl.abuseat.org](http://cbl.abuseat.org) too? or only for Spamhaus?
Thank you!
---
### Author:  [@peer](https://forum.yunohost.org/u/peer)
#### Post date: [October 22, 2025, 12:50am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/39 "2025-10-22T00:50:16Z")
I upgraded to 12.1.29 but keep having the same problem. I don’t receive email and senders get the same rejection message as before : (
```auto
554 5.7.1 Service
unavailable; Client host [11.11.11.11] blocked using cbl.abuseat.org;
Error: open resolver;
https://check.spamhaus.org/returnc/pub/20001:...
```
---
### Author:  [@Aleks](https://forum.yunohost.org/u/Aleks)
#### Post date: [October 22, 2025, 1:27am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/40 "2025-10-22T01:27:31Z")
The situation is not fixed for abuseat, we “just” need to tweak to trigger the same logic as the previous fix …
AlsoiIf i understand correctly, your issue is not about the YunoHost diagnosis results (which is what was fixed, at least for spamhaus) but rather the reception (?) or sending of email from your server … for which we may need another fix in the postfix conf, maybe inspired by what somebody mentioned somewhere else to ignore some results code from spamhaus/abuseat
---
### Author:  [@peer](https://forum.yunohost.org/u/peer)
#### Post date: [October 22, 2025, 8:42am UTC](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469/41 "2025-10-22T08:42:38Z")
As my problem seems to be different, I have created [this new thread](https://forum.yunohost.org/t/cannot-receive-emails-senders-get-an-error-message-related-to-spam/40520).
Any suggestion, even though it is just a temporary fix, it is greatly appreciated.
[Previous page](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469.md?page=1)
[Next page](https://forum.yunohost.org/t/outbound-mail-to-blocked-spamhaus-open-resolver-return-code-need-help-with-yunohost-dns-rspamd-setup/40469.md?page=3)