not all email received

[trend-1]

Hi, first time cloudron user here.

Cloudron version: 9.0.10
Ubuntu version: Ubuntu 24.04.3 LTS Linux 6.8.0-87-generic
Vendor: Hetzner VPS

Sometimes I am getting an error that my IP4 is blacklisted on spamhaus. But checking with spamhaus does not confirm my IP is blacklisted. It seems to be the "open resolver" issue.

Some emails sent to me are not delivered but returned with this error message:

Client host [**.**.***.***] blocked using
    zen.spamhaus.org; Error: open resolver;

I read somewhere that this could be related to the Hetzner public DNS. But I do not know how to resolve this.

Spamhaus mentions steps to solve the issue by signing up to their Spamhaus DQS and making relevant changes to the mail server configuration.
It is not clear to me which steps I have to take in regards to the Cloudron setup.

Can someone help me solve this issue? I am not very technical but do have SSH access to my server.

[james]

Hello @trend-1 and welcome to the Cloudron forum

These days many anti-spam providers are also checking for IPv6.
Please check if IPv6 is enabled and configured.
Also, can you share a screenshot of your mail status form the Cloudron Dashboard?
Did you set the PTR records correctly? See https://docs.cloudron.io/email/#ptr-record

[trend-1]

Hi @james

• IPv6 is enabled and configured correctly
• PTR records are also correctly set

[james]

Hello @trend-1
Since you stated you are a new Cloudron user, I also assume your Cloudron is very fresh.
Meaning, also your mail servers IP reputation started from a negative value (all IPs do that, nothing to worry about).
This issue should resolve itself over some time.
Spamhaus states:

queries made via a public/open server may be blocked

Important keyword is may.

This is mostly due to the negative reputation which will get better pretty fast.
If you wish to get more details on this topic, here is the offical documentation from Spamhaus https://www.spamhaus.com/resource-center/help-for-spamhaus-projects-legacy-blocklist-users/#error-code-127-255-255-254-is-causing-problems-for-my-email-stream

---

As a temporary solution you could simply remove zen.spamhaus.org from your Mail ACL in the Mail Server settings in the Cloudron Dashboard.
There is also this great post from @d19dotca about spam filtering https://forum.cloudron.io/post/105256 if you'd like to improve on that part as well.

[trend-1]

Hi @james ,

Thank you for your reply. Although I am new to Cloudron I did have other servers on the same IP. The reputation is good. Checking on mxtoolbox shows all ok's.

I switched to Cloudron because of a more easy, polished and stable platform (am happy so far ). But I do need to send and receive emails.

I will check the information in the post about spam filtering. Looks interesting.

Still I would like to now the answer, if possible, to my question about what steps to follow when signing up to Spamhaus DQS and making relevant changes to the mail server configuration. What changes would I have to make in Cloudron ?
How to go about ? Or is that a no-go from Cloudron's perspective ?

[joseph]

@trend-1 For incoming mail, it works like this: Cloudron checks incoming email IP against SpamHaus . If found blocked, it will reject the email . So you have to actually check the sending server IP and not your own IP in SpamHaus! Also, you might have to check IPv6 and not IPv4 (this depends on how that external email server connected to yours).

Cloudron is default configured to use SpamHaus but SpamHaus has a "limitation" that it blocks IPv6 addresses wholesale (/64) . See this .

Now for the practical fix:

• You can disable IPv6 for just email on your server. Easiest way to test this is to remove the AAAA record for the MX domain in your DNS provider. If your MX is my.example.com , then go to your DNS provider UI and remove the associated AAAA record of my.example.com .

• Alternately, if you want to keep IPv6, disable SpamHaus. https://docs.cloudron.io/email/#dnsbl . Email -> Settings -> Mail ACL. Remove zen.spamhaus.org there. Ideally, you should put in some other provider which is proficient in IPv6 filtering there (if you find any, let us know , maybe we should make that the default...).

[trend-1]

Hi @joseph I will take a look at your proposed solutions. And see how I can implement that. (And if it works for my usecase.)

@joseph said in not all email received:

So you have to actually check the sending server IP and not your own IP in SpamHaus

When my server checks with Spamhaus on the incoming message (by making a request?) Spamhaus doesn't like it when this is done via a public/open resolver. Resulting in my server bouncing the incoming message.
The error message send to the sender clearly states (after clicking a link) that the problem is with the receiving server not the sending one. Hence my question.

[joseph]

@trend-1 said in not all email received:

When my server checks with Spamhaus on the incoming message (by making a request?) Spamhaus doesn't like it when this is done via a public/open resolver. Resulting in my server bouncing the incoming message.

Cloudron uses an internal resolver (unbound) for exactly this. Have you configured a custom DNS or customized unbound config by any chance?

You can verify like this on the server. If you use the system resolver:

root@my:/etc/unbound/unbound.conf.d# host 76.67.227.165.zen.spamhaus.org
76.67.227.165.zen.spamhaus.org has address 127.255.255.254

127.255.255.254 is error for NXDOMAIN (from the open resolver that DO uses by default).

Now, use unbound:

root@my:/etc/unbound/unbound.conf.d# host 76.67.227.165.zen.spamhaus.org 127.0.0.150
Using domain server:
Name: 127.0.0.150
Address: 127.0.0.150#53
Aliases: 

76.67.227.165.zen.spamhaus.org has address 127.0.0.11

127.0.0.11 means PBL (ISP policy blocks) , so we got a good response.

[girish]

I am adding a feature upstream to prefer ipv4 over ipv6 - https://github.com/haraka/Haraka/pull/3502