What type of hardware are you using: VPS bought online What YunoHost version are you running: YunoHost 12.1.28 How are you able to access your server: SSH Are you in a special context or did you perform specific tweaking on your YunoHost instance ?: no
Describe your issue
utbound mail to blocked: Spamhaus “open resolver” return code – need help with YunoHost DNS/Rspamd setup
Share relevant logs or error messages
Hi everyone,
my outgoing emails to server.de are being rejected. The bounce says:
Spamhaus explains this is not my sender being listed, but that the recipient’s server is querying Spamhaus via public/open DNS resolvers, which triggers a special error code. However, my messages still get blocked at their side.
I encounter since yesterday the same problem.
A lot of persons forwared my the open resolver error message, when they’ve tried to send an e-mail to me.
<ME@myserver.de>: host myserver.de[45.xxx.xxx.xxx] said: 554 5.7.1 Service
unavailable; Client host [145.xxx.xxx.xxx //=server of sender] blocked using cbl.abuseat.org;
Error: open resolver;
https://check.spamhaus.org/returnc/pub/2001:19f0:5000:1800:5400:5ff:fe01:2dc5/
(in reply to RCPT TO command)
According to the following query on my yunohost server, I should have the problem?
You may have to temporarily disable “Enable blocklists for incoming traffic” in the webadmin > Tools > YunoHost settings > Email
It will take time for the rejection to be removed
Spamhaus doesn’t like “public DNS resolvers” (for context : in the context of mail blocklist, DNS queries are used to query the various blocklists to know if an IP/domain is listed as malicious or bad-reputation actor – and the easiest way to perform a DNS query is to just use a public DNS resolver, just like when you’re browsing the web or whatever).
public recursive name servers act as an anonymizing service and enable large-scale users to hide behind them. Given the lack of transparency and inability to identify those who are abusing the free service, a difficult decision was made to add some public domain name servers to our access control list… ultimately blocking your query.
Hence why YunoHost was sometimes getting this “open resolver” as an answer to the queries … which doesn’t mean that your server is listed as a malicious or bad-reputation actor, just that Spamhaus refused to answer the query to know wether or not it is.
However, it didn’t happen all the time, because YunoHost uses a pool of .. public DNS resolvers, some are being refused by Spamhaus, some others aren’t. In particular, the only one that Spamhaus refuses to answer to is DNS4all, which we added a few months ago.
The right fix is to not use any public resolver at all to query spamhaus, but poke directly on Spamhaus NS servers, which are listed for example here.
