Russian DNS Servers?

BrunoZP

As of this morning, mailcow started to query a lot of russian servers, is this normal?
What can be causing this? All dns entries are for local dns.

mlcwuser

Not too much info from your side to work with…

That said, the most likely explanation is that Rspamd or Postscreen is making DNSBL (DNS blacklist) and URIBL lookups to check the sender’s IP reputation. Some obscure RBLs or spam domains may resolve to .ru TLDs or rely on Russian DNS servers.

A less likely, but not impossible explanation is that your server is somehow compromised or infected with malware.

By the way, are you sure it’s actually a service provided by Mailcow making the requests, and not some other service or container running on the server?

BrunoZP

mlcwuser Yes, that started this morning after adding a new domain and it just executed for two periods 22h-23h and this morning 06h-07h.

I’m not taking any chances, I just moved to a new VM.

Just wanted to know if there is a way to identity in mailcow logs what service queried those ips.

mlcwuser

I’d start with the Unbound logs, though to be honest, I’ve never really looked at them that much. I do know that Rspamd and Postscreen both do reverse lookups and check IPs against spam lists, which can definitely generate a lot of DNS queries, if someone’s trying to send mass spam from a bunch of distributed IPs..

However, if you suspect something malicious is going on with your server, I’d try aggregating all your logs and correlating events that happen around the same time those DNS lookups are being made.