Cloudron falsely rejecting email based on spamhaus filters

[tadeas]

Hello,

for the last few days Cloudron has been rejecting some emails from my usual contacts. The response returned to the senders is this one:

Remote Server returned '554 5.7.0 <my.cloudron.net #5.7 smtp;550 5.7.350 Remote server returned message detected as spam -> 550 host [X.X.X.X] is blacklisted by zen.spamhaus.org>'

The ip address is the address of sender's mail server.

How can I troubleshoot?

None of the ip addresses of the sender or the ip address of my cloudron are on the blacklist.

[ccfu]

@tadeas Can you check what the mail log is showing for these mails? Do you see the senders' IPs failing there?

As a quick fix you could try removing zen.spamhaus.org from the list of DNSBL zones in the mail settings.

[james]

@ccfu is correct. We need the mail log for the failing mails to further assist.

[p44]

I've the same problem on different Cloudron installations.

[tadeas]

I am upgraded to latest version of Cloudron, Ubuntu 24.

In the cloudron dashboard, I go to Email, for any domain, I click on edit, then go to "status" tab. There (no matter which domain), it says: This server's IP X.X.X.X is on a blocklist. When I check this IP at spamhaus https://check.spamhaus.org/results/?query=X.X.X.X it says the IP "has no issues".

For the individual email, I was getting this error:

{
"ts": 1747840307360,
"type": "denied",
"direction": "inbound",
"uuid": "8FDCE4A3-2906-4F8A-B9C7-BBC161912131.1",
"messageId": null,
"mailFrom": "<XXX>",
"spamStatus": null,
"mailbox": null,
"quotaPercent": null,
"rcptTo": [
"cloudron@email"
],
"remote": {
"ip": "X.X.X.X",
"port": 26477,
"host": "XXX",
"info": "XXX",
"closed": false,
"is_private": false,
"is_local": false
},
"authUser": null,
"relaying": false,
"pluginName": "delay_deny",
"errorCode": 902,
"message": "host [X.X.X.X] is blacklisted by zen.spamhaus.org",
"rejectionCountLastHour": 0
}

The IP of the sender's server was not blacklisted on Spamhaus.

When I disable Spamhaus check, emails are going through.

However, even with Spamhaus disabled, the Cloudron determines that it's own IP is blacklisted (as referred to in the beginning of this post).

[tadeas]

Now a few minutes later suddenly Cloudron says in the email / status tab that IP is not on a blacklist.

[james]

@tadeas it can be that a rate limit interaction with spam house.
Perhaps with some time all notices will be gone.
But please report back if this is not the case.

[tadeas]

@james do you mean cloudron is prevented from reaching spamhaus? if Cloudron is showing address is blacklisted while spamhaus says ip is not blacklisted when I search for it, it must be a Cloudron error somewhere.

[james]

@tadeas
If the Cloudron IP/Domain is rate limited for checking if domain XYZ is blacklisted or not by spamhaus.
It might return a faulty result that will be interpreted into "is on blacklist" by Cloudron.
So yes, this might be a bug from Cloudron.

@staff me might want to look into this scenario.

[ccfu]

Rate-limiting seems to be happening with SpamHaus quite a lot recently, but I have not yet had the issue that Cloudron is interpreting a failed connection as the IP being blacklisted. That would be very bad, but I wonder if it is maybe linked to the problem that Cloudron reports the server IP as being on a blacklist if it cannot connect during outbound mail configuration checks.

[sponch]

Same here since the last days.
In mail status my IP is „blacklisted at spamhouse“ next minute it isn’t.
Spmahosue itself showing „no issues“ with that IP.

[tadeas]

Would this be relevant?

https://www.spamhaus.com/product/help-for-spamhaus-public-mirror-users/

[d19dotca]

What's strange about this to me is I seem to be unaffected (so far at least), and I'm looking in Cloudron mail pages quite frequently. Not sure why but I am throwing this out there in case it has something to do with the region IP of the Cloudron servers? I'm located in Canada, in case that matters at all. I just wonder if there's a pattern for this perhaps with certain countries affected more than others, etc.

Though I guess ultimately if Cloudron isn't properly accounting for blocked connections to Spamhaus and seeing a blocked connection as a listing, then that should still be fixed in the code if that's true.

Sorry, ignore me I think, as I misunderstood the problem. I thought this was around Cloudron detecting that the IP of Cloudron was on the blocklist, but that would have no bearing on rejecting emails so I think I misunderstood. Sorry about that.