Outbound DNS requests

makwork

Hi All
Since a couple of weeks i see that my mailcow server (dockerized version) is actually do a lot of DNS requests to external servers. It is quite frequently so around each 1 or 2 minute they are several requests.

Is this a normal behavior from unbound or spamd? It looks quite wired.

My Version is 2023-10a

thanks

esackbauer

This is normal. For Reverse DNS and blacklist checks, SPF, DMARC and DKIM and the likes DNS requests are needed.
So that can easily be 10-20 DNS requests per mail.

makwork

Thanks for your answering! But actually receive just one or two mails per day. But today the mailcow requested around 22K on different external dns server.

This seems to me quite heavy

esackbauer

makwork
If you have an open SMTP port, it will be tested by spammers and relay tests. This should not be surprising 😉
Each one will at least cause a reverse DNS request and blacklist lookup.
Look at your postfix and rspamd logs.

makwork

And this is the main difference about it. I have the mailcow not directly open because i have in my DMZ an own spam appliance which take care about it.

And this will forward already cleaned mails to the mailcow. Also the postfix logs are more or less clean/empty. So it is really strange why it should do such huge amount of requests.