Cloudron falsely rejecting email based on spamhaus filters

[ccfu]

@tadeas Can you check what the mail log is showing for these mails? Do you see the senders' IPs failing there?

As a quick fix you could try removing zen.spamhaus.org from the list of DNSBL zones in the mail settings.

[james]

@ccfu is correct. We need the mail log for the failing mails to further assist.

[p44]

I've the same problem on different Cloudron installations.

[tadeas]

I am upgraded to latest version of Cloudron, Ubuntu 24.

In the cloudron dashboard, I go to Email, for any domain, I click on edit, then go to "status" tab. There (no matter which domain), it says: This server's IP X.X.X.X is on a blocklist. When I check this IP at spamhaus https://check.spamhaus.org/results/?query=X.X.X.X it says the IP "has no issues".

For the individual email, I was getting this error:

{
  "ts": 1747840307360,
  "type": "denied",
  "direction": "inbound",
  "uuid": "8FDCE4A3-2906-4F8A-B9C7-BBC161912131.1",
  "messageId": null,
  "mailFrom": "<XXX>",
  "spamStatus": null,
  "mailbox": null,
  "quotaPercent": null,
  "rcptTo": [
    "<cloudron@email>"
  ],
  "remote": {
    "ip": "X.X.X.X",
    "port": 26477,
    "host": "XXX",
    "info": "XXX",
    "closed": false,
    "is_private": false,
    "is_local": false
  },
  "authUser": null,
  "relaying": false,
  "pluginName": "delay_deny",
  "errorCode": 902,
  "message": "host [X.X.X.X] is blacklisted by zen.spamhaus.org",
  "rejectionCountLastHour": 0
}

The IP of the sender's server was not blacklisted on Spamhaus.

When I disable Spamhaus check, emails are going through.

However, even with Spamhaus disabled, the Cloudron determines that it's own IP is blacklisted (as referred to in the beginning of this post).

[tadeas]

Now a few minutes later suddenly Cloudron says in the email / status tab that IP is not on a blacklist.

[james]

@tadeas it can be that a rate limit interaction with spam house.
Perhaps with some time all notices will be gone.
But please report back if this is not the case.

[tadeas]

@james do you mean cloudron is prevented from reaching spamhaus? if Cloudron is showing address is blacklisted while spamhaus says ip is not blacklisted when I search for it, it must be a Cloudron error somewhere.

[james]

@tadeas
If the Cloudron IP/Domain is rate limited for checking if domain XYZ is blacklisted or not by spamhaus.
It might return a faulty result that will be interpreted into "is on blacklist" by Cloudron.
So yes, this might be a bug from Cloudron.

@staff me might want to look into this scenario.

[ccfu]

Rate-limiting seems to be happening with SpamHaus quite a lot recently, but I have not yet had the issue that Cloudron is interpreting a failed connection as the IP being blacklisted. That would be very bad, but I wonder if it is maybe linked to the problem that Cloudron reports the server IP as being on a blacklist if it cannot connect during outbound mail configuration checks.

[sponch]

Same here since the last days.
In mail status my IP is „blacklisted at spamhouse“ next minute it isn’t.
Spmahosue itself showing „no issues“ with that IP.

[tadeas]

Would this be relevant?

https://www.spamhaus.com/product/help-for-spamhaus-public-mirror-users/

[d19dotca]

What's strange about this to me is I seem to be unaffected (so far at least), and I'm looking in Cloudron mail pages quite frequently. Not sure why but I am throwing this out there in case it has something to do with the region IP of the Cloudron servers? I'm located in Canada, in case that matters at all. I just wonder if there's a pattern for this perhaps with certain countries affected more than others, etc.

Though I guess ultimately if Cloudron isn't properly accounting for blocked connections to Spamhaus and seeing a blocked connection as a listing, then that should still be fixed in the code if that's true.

Sorry, ignore me I think, as I misunderstood the problem. I thought this was around Cloudron detecting that the IP of Cloudron was on the blocklist, but that would have no bearing on rejecting emails so I think I misunderstood. Sorry about that.

[james]

Hello @tadeas
Is this still an issue or can this topic be marked as solved?