Mailcow relaying spam, even though open relay is disabled

ETNyx

Ok sorry bad news you are open relay but only on IPv6, you need to fix this.

Quick fix is to disable IPv6, other than that check first mynetworks, relayhost and smtpd_relay_restrictions

post here what print those docker exec -it mailcowdockerized-postfix-mailcow-1 postconf mynetworks check your real container name,…

kolaente

ETNyx

Here are the values:

$ grep relayhost data/conf/postfix/*.cf
data/conf/postfix/main.cf:relayhost =

$ grep smtpd_relay_restrictions data/conf/postfix/*.cf -A 5
data/conf/postfix/main.cf:smtpd_relay_restrictions = permit_mynetworks,
data/conf/postfix/main.cf-  permit_sasl_authenticated,
data/conf/postfix/main.cf-  defer_unauth_destination

$ docker exec -it mailcowdockerized-postfix-mailcow-1 postconf mynetworks
mynetworks = 127.0.0.0/8 172.22.1.0/24 [::1]/128 [fd4d:6169:6c63:6f77::]/64 [fe80::]/64

DocFraggle

Are you running a supported OS? I found this GitHub issue regarding Arch Linux which seems to cause this problem as well

mailcow/mailcow-dockerized5242

kolaente

DocFraggle I’ve been running this on the same Debian server since 7 years.

DocFraggle

kolaente I’ve been running this on the same Debian server since 7 years.

So which Debian version is this? 9? And your mailcow, is it up to date?

ETNyx

What docker version are you on?

And those config lines seems to be good

DocFraggle

Also check your “Forwarding Hosts” in the mailcow UI, maybe you added the IPv6 address there accidentially?

kolaente

Docker version:

Client: Docker Engine - Community
 Version:           26.1.4
 API version:       1.45
 Go version:        go1.21.11
 Git commit:        5650f9b
 Built:             Wed Jun  5 11:29:15 2024
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          26.1.4
  API version:      1.45 (minimum version 1.24)
  Go version:       go1.21.11
  Git commit:       de5c9cf
  Built:            Wed Jun  5 11:29:15 2024
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          1.6.33
  GitCommit:        d2d58213f83a351ca8f528a95fbd145f5654e957
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e94
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

DocFraggle Also check your “Forwarding Hosts” in the mailcow UI, maybe you added the IPv6 address there accidentially?

Is that this config? I don’t have anything configured there.

The IP address is set up in the mailcow.conf, but I guess that was done during the installation?

DocFraggle

kolaente The IP address is set up in the mailcow.conf

Where is it set there? My public IP isn’t in the mailcow.conf file, only the local IPv6 docker network

kolaente

DocFraggle It is set like this:

# Internal IPv6 subnet in fc00::/7
IPV6_NETWORK=fd4d:6169:6c63:6f77::/64

The IP is the one used by the br-mailcow network interface. I assume this is similar to local networks (like 10.0.0.0 or 192.168.0.0)? I can’t remember configuring this explicitly, I assume this was done during the mailcow setup.

[unknown] If I disable ipv6, does that mean other servers won’t be able to talk to my mailcow using ipv6? Or is that separate and should work as long as my server has a public ipv6 address (which it does)?

stefan21

@kolaente

I suppose, you have a static business ipv4.

If your installation/configuration is o.k., you may follow this: https://community.mailcow.email/d/5310-rspamd-error-httpfuzzymailcowemailbad-subject-regextxt/8

Ignore the fuzzy things - just disable ipv6.

Should solve your problem.

DocFraggle

kolaente Yes, ths is just the local IPv6 etwork, not your public IPv6 address. The public IPv6 address is also configured on your host, right? No reverse proxy / NAT stuff or something like this?

kolaente

DocFraggle it is configured on the host (I see it for the eth0 interface when running ip a).

kolaente

DocFraggle It is running on Debian 12, mailcow 2025-07. I guess that’s up to date.

DocFraggle

Ah ok, I thought it’s an older version because you wrote something about 7 years 🙂

But that’s exactly what I’m running, too. Very strange… you could try to check for potential diffs by running

git diff refs/tags/2025-07 data/

in your mailcow-dockerized dir. There will be legit diffs there, but you can check if there’s something else which you may have done in the past

kolaente

DocFraggle It seems like the only modifications are autogenerated config, nothing related to ipv6 or relay functionality:

diff --git a/data/assets/ejabberd/sqlite/sqlite.db b/data/assets/ejabberd/sqlite/sqlite.db
new file mode 100644
index 00000000..981ba6b9
Binary files /dev/null and b/data/assets/ejabberd/sqlite/sqlite.db differ
diff --git a/data/conf/ejabberd/autogen/ejabberd_acl.yml b/data/conf/ejabberd/autogen/ejabberd_acl.yml
new file mode 100644
index 00000000..21db66a4
--- /dev/null
+++ b/data/conf/ejabberd/autogen/ejabberd_acl.yml
@@ -0,0 +1 @@
+# Autogenerated by mailcow
diff --git a/data/conf/ejabberd/autogen/ejabberd_api.yml b/data/conf/ejabberd/autogen/ejabberd_api.yml
new file mode 100644
index 00000000..58c0ffd7
--- /dev/null
+++ b/data/conf/ejabberd/autogen/ejabberd_api.yml
@@ -0,0 +1,16 @@
+# Autogenerated by mailcow
+api_permissions:
+  "Reload by mailcow":
+    who:
+      - ip: "172.22.1.0/24"
+    what:
+      - "reload_config"
+      - "restart"
+      - "list_certificates"
+      - "list_cluster"
+      - "join_cluster"
+      - "leave_cluster"
+      - "backup"
+      - "status"
+      - "stats"
+      - "muc_online_rooms"
diff --git a/data/conf/ejabberd/autogen/ejabberd_hosts.yml b/data/conf/ejabberd/autogen/ejabberd_hosts.yml
new file mode 100644
index 00000000..21db66a4
--- /dev/null
+++ b/data/conf/ejabberd/autogen/ejabberd_hosts.yml
@@ -0,0 +1 @@
+# Autogenerated by mailcow
diff --git a/data/conf/ejabberd/autogen/ejabberd_macros.yml b/data/conf/ejabberd/autogen/ejabberd_macros.yml
new file mode 100644
index 00000000..59bcdf7f
--- /dev/null
+++ b/data/conf/ejabberd/autogen/ejabberd_macros.yml
@@ -0,0 +1,4 @@
+# Autogenerated by mailcow
+define_macro:
+  'MAILCOW_HOSTNAME': "mail.kolaente.de"
+  'EJABBERD_HTTPS': 5443
diff --git a/data/conf/postfix/main.cf b/data/conf/postfix/main.cf
index 07065f04..44d33142 100644
--- a/data/conf/postfix/main.cf
+++ b/data/conf/postfix/main.cf
@@ -174,3 +174,35 @@ lmtp_destination_recipient_limit=1

 # DO NOT EDIT ANYTHING BELOW #
 # Overrides #
+
+postscreen_dnsbl_sites = wl.mailspike.net=127.0.0.[18;19;20]*-2
+  hostkarma.junkemailfilter.com=127.0.0.1*-2
+  list.dnswl.org=127.0.[0..255].0*-2
+  list.dnswl.org=127.0.[0..255].1*-4
+  list.dnswl.org=127.0.[0..255].2*-6
+  list.dnswl.org=127.0.[0..255].3*-8
+  bl.spamcop.net*2
+  bl.suomispam.net*2
+  hostkarma.junkemailfilter.com=127.0.0.2*3
+  hostkarma.junkemailfilter.com=127.0.0.4*2
+  hostkarma.junkemailfilter.com=127.0.1.2*1
+  backscatter.spameatingmonkey.net*2
+  bl.ipv6.spameatingmonkey.net*2
+  bl.spameatingmonkey.net*2
+  b.barracudacentral.org=127.0.0.2*7
+  bl.mailspike.net=127.0.0.2*5
+  bl.mailspike.net=127.0.0.[10;11;12]*4
+  dnsbl.sorbs.net=127.0.0.10*8
+  dnsbl.sorbs.net=127.0.0.5*6
+  dnsbl.sorbs.net=127.0.0.7*3
+  dnsbl.sorbs.net=127.0.0.8*2
+  dnsbl.sorbs.net=127.0.0.6*2
+  dnsbl.sorbs.net=127.0.0.9*2
+  zen.spamhaus.org=127.0.0.[10;11]*8
+  zen.spamhaus.org=127.0.0.[4..7]*6
+  zen.spamhaus.org=127.0.0.3*4
+  zen.spamhaus.org=127.0.0.2*3
+
+# User Overrides
+myhostname = mail.kolaente.de
+
diff --git a/data/conf/sogo/sogo.conf b/data/conf/sogo/sogo.conf
index 2c8d80a1..6fa6834d 100644
--- a/data/conf/sogo/sogo.conf
+++ b/data/conf/sogo/sogo.conf
@@ -5,7 +5,7 @@
         PrivateDAndTViewer
     );

-    WOWorkersCount = "20";
+    WOWorkersCount = "7";
     SOGoACLsSendEMailNotifications = YES;
     SOGoAppointmentSendEMailNotifications = YES;
     SOGoDraftsFolderName = "Drafts";
diff --git a/data/web/.well-known/mta-sts.txt b/data/web/.well-known/mta-sts.txt
new file mode 100644
index 00000000..3ae76dd8
--- /dev/null
+++ b/data/web/.well-known/mta-sts.txt
@@ -0,0 +1,4 @@
+version: STSv1
+mode: enforce
+max_age: 15552000
+mx: mail.kolaente.de

DocFraggle

OK, I’m out of ideas… did you try stopping the stack, rebooting and starting it again?

kolaente

Just upgraded to 2025-09. Since they changed a few things regarding ipv6 in the update, maybe that has fixed it? How can I test this?

DocFraggle

Still the same unfortunately…

# telnet 2a01:4f8:1c1c:56c7::1 25

Trying 2a01:4f8:1c1c:56c7::1...
Connected to 2a01:4f8:1c1c:56c7::1.
Escape character is '^]'.
220 mail.kolaente.de ESMTP Postcow
ehlo test.de
250-mail.kolaente.de
250-PIPELINING
250-SIZE 104857600
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from: test@test.de
250 2.1.0 Ok
rcpt to: postmaster@gmail.com
250 2.1.5 Ok
quit
221 2.0.0 Bye
Connection closed by foreign host.

According to my toolbox your VPS is running at Hetzner? Did you check your network config? See:

https://docs.mailcow.email/getstarted/prerequisite-system/#hetzner-cloud-and-probably-others

Mine is running at Hetzner as well and iirc I did this before installing mailcow

kolaente

DocFraggle It seems I’ve done the changes at some point.

I had another idea: Given how docker works, isn’t the ip when it reaches postfix always the ip of the container it came through? That would mean postfix will accept any ip because they all look as if they would come from the same internal container. How can I verify if that’s the case?

But I have no idea if this is how ipv6 works soooo…