The IPV6 address for my mailcow server has recently been listed in two of the spamhaus lists, not for sending spam, but for a configuration related issue.

Here is what the spamhaus explanation for the listing says:

Why was this IP listed?
This IP is making SMTP connections with HELO values that use a bare IP address (a bare IP address looks like: 192.2.0.1). This behaviour is commonly associated with various botnets, and is a violation of the SMTP protocol as defined in RFC2821/5321 section 4.1.1.1.

The most recent detection was at: May 8 2021, 18:20:00 UTC (+/- 5 minutes)

Only the IPV6 address is listed and when I try testing the HELO by sending an email through my server to helocheck@abuseat.org, the bounce indicates that the email went via the IPV4 network and the HELO syntax comes back fine with the HELO reporting as the FQDN (not a bare IP) for my mailcow server.

I have been running mailcow dockerized on this same VPS without any such issues for > three years. The server has (and has always had) correctly configure PTR records for both its IPV4 and IPV6 addresses both of which point to the FQDN of the mailcow server. The VPS is dedicated to running mailcow - there are no other services running on it besides mailcow.

The spamhaus listing is recent and nothing I am aware of has changed in the mailcow server’s configuration - other than keeping up with mailcow updates.

So two questions:

  1. Is it possible that mailcow is somehow using a bare IP for the HELO of IPV6 connections?
  2. is there any way to test the HELO but constrain the test to be IPV6?

  • diekuh

    • Community Hero
    • volunteer
    Moolevel 110
  • Post #2

No, we don’t do that.

Have something to say?

Join the community by quickly registering to participate in this discussion. We'd like to see you joining our great moo-community!

2 years later

Hi, i face the same exact issue (my ipv6 address 2400:8901::f03c:93ff:fe29:a68a was listed in spamhaus’ lists). Is there a way to resolve this?

What I found when I dug deeply into it is that spamhaus and probably other RBLs reach way back further into the IPV6 address than you can likely control. Probably they consider your address to be the same “host” as every other host that has the 2400:8901:: prefix. Or maybe 2400:8901::f03c:93ff.

In any case, what I had to do for deliverability was to just disable sending via IPV6 altogether.

    pjv I see, thank you for sharing what you have found!

      No one is typing