Hi everyone, I’m encountering an issue with my Mailcow server where outgoing emails to certain recipients are being rejected. The error message I’m seeing is as follows: [upl-image-preview uuid=a9334f7d-e594-451e-a5c9-c1e54c741d91 url=https://community.mailcow.email/assets/files/2025-01-27/1737974090-595364-screenshot-2025-01-27-160211.png alt={TEXT?}] even we have tried to unbloack our IP address in spamhaus it not works.

Hi all, Thank you for your wonderful suggestions. We have already added the PTR record in our DNS, and for your reference, I have attached a screenshot below. Additionally, I have reviewed the logs from the Postfix service on our Mailcow server and included them in this email for your reference. [upl-image-preview uuid=1751c168-8574-4407-a497-b08b17bbe4cf url=https://community.mailcow.email/assets/files/2025-01-28/1738048931-512696-image.png alt={TEXT?}] [upl-image-preview uuid=1a1e4563-0793-4008-90a7-7629fb267f69 url=https://community.mailcow.email/assets/files/2025-01-28/1738048973-853257-image.png alt={TEXT?}] [upl-image-preview uuid=dedbb3bd-4b1f-4c94-a3df-f6b221183874 url=https://community.mailcow.email/assets/files/2025-01-28/1738049000-833344-image.png alt={TEXT?}] Kindly review the provided details and assist us in resolving the issue. Looking forward to your response.

IP Blocked by Spamhaus

praba

Hi everyone,
I’m encountering an issue with my Mailcow server where outgoing emails to certain recipients are being rejected. The error message I’m seeing is as follows:

even we have tried to unbloack our IP address in spamhaus it not works.

ETNyx

What do you expect from us? We do not have crystal ball, at least disclose your IP so we can check your status,…

pkernstock

There is nothing we/the community can do about this, unfortunately. You’d need to query Spamhaus to get your IP removed from their list.

praba

Hi all, Thanks for reply

ETNyx

Also reason why I ask you for IP is that, even you try to hide your IP, one can still guess, my guess leads to IP banned on Spamhouse as you are, usually we do more checks if someone is in some kind of trouble and for this guess IP, there is no PRT record,… So, if you still do not want to disclose your IP please double check this,… There is reason why you are on spamlist and if you do not know what is it, even when they delist you, you can pop up there again pretty quickly,…

esackbauer

The reason why he is on the blacklist is probably because he is running on a home internet address…
https://check.spamhaus.org/results?query=19.204.233.212
And yes, there is no PTR record. Which is necessary.

Do yourself a favor and move mailcow either to an internet provider with proper static IP addresses or to a proper hoster.

maybl8

I am on a home network with a dynamic IP on spectrum internet.
I use sendgrid to send mail exactly due to this issue.

esackbauer

maybl8 I use sendgrid to send mail exactly due to this issue.

That is also possible, however then a third party can read the outgoing mails and possibly sell your data. For me that is one of the major reasons to run my own mail server on a proper static IP address.

maybl8

I don’t want to get into the whole “sell your data” debate. My data has been stolen by so many “secure” vendors ones that could afford way better security than me. But you are correct. My server is not for a business or I would consider what you said.

praba

Hi all,
Thank you for your wonderful suggestions.

We have already added the PTR record in our DNS, and for your reference, I have attached a screenshot below. Additionally, I have reviewed the logs from the Postfix service on our Mailcow server and included them in this email for your reference.

Kindly review the provided details and assist us in resolving the issue.

Looking forward to your response.

DocFraggle

Did you have a look at https://check.spamhaus.org/results/?query=49.204.235.212 ?
It states that you are listed at the CSS blocklist due to:

Your IP address is either exhibiting suspect behavior, is misconfigured, or has a poor sending reputation.

Why is 49.204.235.212 listed?
49.204.235.212 is making SMTP connections that leads us to believe it is infected with malware.

Technical information
Recent connections:

(IP, UTC timestamp, HELO value)

49.204.235.212 2025-01-28 05:10:00 desktop-rh1ot7o
49.204.235.212 2025-01-27 05:15:00 desktop-rh1ot7o
49.204.235.212 2025-01-24 05:15:00 desktop-rh1ot7o
49.204.235.212 2025-01-22 11:10:00 desktop-rh1ot7o
49.204.235.212 2025-01-21 06:00:00 desktop-rh1ot7o

Are you sending out some kind of bulk email?

praba

No, we didn’t tried to sending out bulk email.

ETNyx

Guess that “desktop-rh1ot7o” is not hostname of your MC instance right?
Any chance that IP is NAT(ed) and multiple computers can act like this IP? Than desktop-rh1ot7o can be source of bulk/spam emails,…

DocFraggle

Are you running your mailcow at home? Is 49.204.235.212 your local ISP IP address? And you’re running multiple devices at home? Is desktop-rh1ot7o a local Windows computer infected by a trojan of some kind sending out SPAM?

praba

Currently we are using same email domain for both outlook and mailcow domain. An example scenario is let’s say our domain name is abc.com it is being assigned to both outlook users and mailcow mail users.

We have re-attached the postfix logs for your reference. With the above scenario taken into consideration, kindly advise on the same

ETNyx

praba With the above scenario taken into consideration, kindly advise on the same

You mean you have your IP/network as me and @DocFraggle describe? Than you need to keep you network under strict control. For example why desktop-rh1ot7o communicate whit SMTP server like “server to server” and not “client to server”? That is most likely reason why you are on CSS Blocklist,…

I believe until then, there is only one reasonable advice, move your MC instance to propper hoster like some reasonable VPS and always consider MC requirements

DocFraggle

Can’t really help you here. Check your network for a computer named “desktop-rh1ot7o” and check it for malware etc