Spamhaus rejects with "Error: open resolver"

[chrisblech]

With the current postfix configuration:

smtpd_recipient_restrictions =
[...]
   reject_rbl_client zen.spamhaus.org,
   permit

...all mails are rejected, with the following message: NOQUEUE: reject: RCPT from <redacted>: 554 5.7.1 Service unavailable; Client host [redacted] blocked using zen.spamhaus.org; Error: open resolver; https://check.spamhaus.org/returnc/pub/46.38.225.230/

Following the provided link, spamhaus says:

• The problem is with the recipient’s email server configuration.
• It is not because you are listed on one of our blocklists.
• This page provides the information required to correct this issue: Using our public mirrors? Check your return codes now.
• To succesfully query Spamhaus via public/open resolvers, there is a FREE service which delivers the intelligence faster and with additional blocklists available to increase catch-rates: Spamhaus Data Query Service

I will open a PR shortly, that a) explains how to obtain a DQS-key in README, b) changes postfix config to use this key when provided, c) skip spamhaus filter, when no DQS-key is provided

[springcomp]

@chrisblech

I cannot reproduce that issue.
However, I’m indeed interested in thoses changes.

I have no problems receiving emails from the outside world – this is my main use case.
When I reply to those emails, it goes through the reverse-alias address and, from there, it sent by SimpleLogin to the recipient.

Can you clarify how to reproduce ?

[springcomp]

@chrisblech I suspect your issue is with DNS setup.

The error states: Error open resolver
https://www.radware.com/blog/ddos-protection/the-dark-side-of-open-resolvers-in-dns-security/

Here is the link to the relevant page:
https://check.spamhaus.org/returnc/pub/46.38.225.230/

The following paragraph (emphasis mine) might shed some clue:

To succesfully query Spamhaus via public/open resolvers, there is a FREE service which delivers the intelligence faster and with additional blocklists available to increase catch-rates: Spamhaus Data Query Service. Here are the details of how to make the change:

• Sign up for the free Spamhaus Data Query Service. The same usage terms apply.
• Make the relevant change to your server configuration. The Spamhaus Technical Documentation site has full configuration details for many mail servers and anti spam solutions.

Alternatively, if you’d like to continue using the free public infrastructure, please ensure that your queries come from a dedicated IP with attributable reverse and forward DNS. Here is information on how to correctly configure commonly used MTAs for use with the public mirrors.

[springcomp]

Could we implement spamhaus like this:

• If the DQS key is present, use the Data Query Service (this pull request)
• if not, use the public mirrors ? (instead of disabling)

I started #40 to make it possible in the future more easily.
What do you think?

[chrisblech]

I enhanced PR #38 with a check on startup, that can automatically decide between using public mirror and disabling.

Your #40 also looks good to me, I would only suggest deleting templates/main.cf.tpl instead of adding it to .gitignore