DNSBL zen.spamhaus.org errors and timeouts

[ccfu]

Recently we have notices regular errors in the mailserver logs:

Jun 25 15:14:16 [WARN] [-] [dnsbl] disabling zone 'zen.spamhaus.org'
Jun 25 15:14:16 [WARN] [-] [dnsbl] zone 'zen.spamhaus.org' did not respond to test point (Error: queryA ESERVFAIL 2.0.0.127.zen.spamhaus.org.)
Jun 25 15:14:16 [INFO] [-] [dnsbl] re-enabling zone zen.spamhaus.org

On incoming emails we get this:

[dnsbl] queryA ESERVFAIL xxx.xxx.xxx.xxx.zen.spamhaus.org

This is happening on perhaps 40% of incoming mails.

I assume it is a problem with the DNSBL and not with the mailserver and in any case these errors only started appearing a few weeks ago. I know that sometimes spamhaus.org block IP ranges if an excessive number of queries are made, but would assume that this would result in the error appearing all the time.

[girish]

Yes, spamhaus also blocks things if you query via Google DNS. Have you customized your unbound configuration by any chance?

[ccfu]

No, I haven't changed anything at all in the Unbound configuration.

[ccfu]

Can somebody perhaps recommend a reliable and secure (non-Google) DNS that I could test forwarding DNS queries to in Unbound? I suspect the hoster's DNS to be the cause.

[Kubernetes]

Certainly! There are several reliable and secure DNS providers that you can use as an alternative to Google DNS. Here are a few recommendations:

Cloudflare DNS: Cloudflare provides a fast and secure DNS service that prioritizes privacy. Their primary DNS server is 1.1.1.1, and the secondary server is 1.0.0.1.

OpenDNS: OpenDNS is another popular DNS provider known for its security features. Their primary DNS server is 208.67.222.222, and the secondary server is 208.67.220.220.

Quad9: Quad9 offers a secure DNS service that focuses on blocking malicious websites and protecting users' privacy. Their primary DNS server is 9.9.9.9, and the secondary server is 149.112.112.112.

Please note that although these DNS providers are generally reliable and secure, it's always a good idea to review their respective privacy policies and terms of service to ensure they meet your specific requirements.

[ccfu]

@Kubernetes Thank you for your recommendations.

[ccfu]

OK, that isn't the solution as spamhaus blocks all public resolvers, not just Google. I'll continue to obseve this as maybe it is just a temporary blip.

[girish]

You can also try to use some of the other DNSBL listed here - https://docs.cloudron.io/email/#dnsbl