How can I allow a mail that is getting rejected do to error BAD_IPS?

@"mlcwuser"#p32929 I'm not running the script right now but I have these in my block list: would this cover the one that is being rejected? [code] 209.85.160.0/32 209.85.161.0/32 209.85.167.0/32 209.85.210.0/32 209.85.214.0/32 209.85.217.0/32 209.85.219.0/32 209.85.222.0/32 [/code]

Bad_IPS

ETNyx

Hello, please can you be more specific I do not think there is BAD_IPS https://github.com/search?q=repo%3Amailcow%2Fmailcow-dockerized%20BAD_IPS&type=code and I do not believe there is some in rspamd,…

Aside this, you can whitelist e-mail, or wildcard domain in MC UI, those mails should bypass those rspamd checks and be delivered,…

maybl8

ETNyx
This is what I see and what I have in the settings:

07/31/2026, 09:22:28
postfix/cleanup
5D663200415: message-id=<CAD_4cn8kJsNXGsbm+2pvjupQt4MtRyTzn44ZmGzyXzgTE0LC0Q@mail.gmail.com>

07/31/2026, 09:22:28
postfix/smtpd
5D663200415: client=mail-ed1-f52.google.com[209.85.208.52]

07/31/2026, 09:22:28
postfix/cleanup
=> danc@dccathome.com
5D663200415: prepend: header Content-Transfer-Encoding: base64 from mail-ed1-f52.google.com[209.85.208.52]; from=<oryanvillage@gmail.com> to=<danc@dccathome.com> proto=ESMTP helo=<mail-ed1-f52.google.com>: List-Unsubscribe: mailto:<contact@mydomain.com>?subject=unsubscribe>"

07/31/2026, 09:22:28
postfix/cleanup
=> danc@dccathome.com
5D663200415: prepend: header Content-Transfer-Encoding: quoted-printable from mail-ed1-f52.google.com[209.85.208.52]; from=<oryanvillage@gmail.com> to=<danc@dccathome.com> proto=ESMTP helo=<mail-ed1-f52.google.com>: List-Unsubscribe: mailto:<contact@mydomain.com>?subject=unsubscribe>"

07/31/2026, 09:22:29
postfix/cleanup
5D663200415: removed (canceled)

07/31/2026, 09:22:29
postfix/cleanup
=> danc@dccathome.com
5D663200415: milter-reject: END-OF-MESSAGE from mail-ed1-f52.google.com[209.85.208.52]: 5.7.1 Matched map: BAD_IPS; from=<oryanvillage@gmail.com> to=<danc@dccathome.com> proto=ESMTP helo=<mail-ed1-f52.google.com>

Header From Allowlist has this:

/oryanvillage@gmail\.com/i

But it is still blocking these email. It seem to block ones specifically with attachments.

mlcwuser

Are you still using this script? https://community.mailcow.email/d/4527-massive-bruteforce-attack-since-weeks/191

If so, I’d say the BAD_IPS are coming from this script and that the IP in question probably has ended up on one of the blocklists the script uses.

maybl8

mlcwuser
I’m not running the script right now but I have these in my block list:
would this cover the one that is being rejected?

209.85.160.0/32
209.85.161.0/32
209.85.167.0/32
209.85.210.0/32
209.85.214.0/32
209.85.217.0/32
209.85.219.0/32
209.85.222.0/32

esackbauer

Those are not meaningful CIDRs. You have not understood how subnet masks work it seems.
209.85.219.0/32 means that it is only referring to the single IP address of 209.85.219.0
Nothing can be blocked by these 8 IP “ranges”, because most likely that are only reserved IP addresses (the .0) which should never be used.

maybl8

Without taking a course to learn what I have done wrong. What would be the correct way to use the block list To get a range of IP blocked from say 209.85.219.0 - 209.85.219.255?

ETNyx

209.85.219.0/24

https://cidr.xyz/

maybl8

Thanks for that . That is a very helpful tool.
Back to my issue I am having . Since I have the /32 in the blocked list as of now. That couldn’t be my issue then for the blocked emails . Is there some way I can get the the source of this issue so I can get these emails. It seems it has to do with attachments specifically at this point. I am getting mails from that address without attachments. It doesn’t appear to be the kind of attachments. They are sending PDF files I believe.

esackbauer

For me it seems the last line in your log is the clue: “milter-reject”.
As milter is running within postfix, more likely gmails IP address is the problem.
Try to whitelist the /24 range from google 209.85.208.0/24 here:
https://docs.mailcow.email/manual-guides/Postfix/u_e-postfix-postscreen_whitelist/
Could also that you have somewhere blocked the IP address somewhere else?

maybl8

esackbauer
This is what I have added to the whitlist:

# Autogenerated by mailcow
# Rules are evaluated in the order as specified.
# Blacklist 192.168.* except 192.168.0.1.
192.168.68.1          permit
192.168.0.0/16       reject
209.85.208.0/24			permit

The only other blocking I am doing is with crowdsec. I think for testing I will remove that also.

esackbauer

I dont know how picky postfix is regarding that config file, but the line you added is a mix of space and tabs. I suggest you use only 1 tab, or all spaces.

maybl8

esackbauer
The entries above had spaces so I changed it to spaces.
Do I need to restart the container for it to take affect?

Also what is your opinion on using crowdsec? After looking at the logs after a reboot I see this and I think crowdsec it causing this message:

08/02/2026, 10:08:27 MAILCOW target is in position 2 in the ip input table, restarting container to fix it...
08/02/2026, 10:08:29 Allowlist was changed, it has 1 entries
08/02/2026, 10:08:29 Watching Redis channel F2B_CHANNEL
08/02/2026, 10:09:19 MAILCOW target is in position 2 in the ip6 input table, restarting container to fix it...
08/02/2026, 10:09:22 Allowlist was changed, it has 1 entries
08/02/2026, 10:09:22 Watching Redis channel F2B_CHANNEL
08/02/2026, 10:09:42 MAILCOW target is in position 2 in the ip6 input table, restarting container to fix it...
08/02/2026, 10:09:44 Allowlist was changed, it has 1 entries
08/02/2026, 10:09:44 Watching Redis channel F2B_CHANNEL
08/02/2026, 10:10:14 MAILCOW target is in position 2 in the ip input table, restarting container to fix it...
08/02/2026, 10:10:16 Allowlist was changed, it has 1 entries

esackbauer

maybl8 Do I need to restart the container for it to take affect?

In the doc it reads: “The file is reloaded on the fly, postfix restart is not required.”

Regarding Crowdsec I cannot really tell, I use it but in my Sophos Firewall which is in front of mailcow. So far no problems for me.