Question Global Whitelist does not apply on Greylisting?

[gnilebein]

Server operating system version

Ubuntu 22.04

Plesk version and microupdate number

Plesk Obsidian Web Host Edition Version 18.0.52 Update Nr. 3

Hello all,

we have a small global whitelist of domain patterns. However, it seems to me that this does not apply to greylisting.

This is our whitelist:

Grey listing configuration.

Grey listing checking enabled
Grey interval 5 minutes
Expire interval 51840 minutes
Penalty interval 2 minutes
Penalty disabled
Personal grey listing
configuration allowed

Server-wide black list:

Server-wide white list:
*@exampledomain1.tld
*@exampledomain2.tld
*@exampledomain3.tld

White domains patterns list:
*.office365.com
*.outlook.com
*.outlook.office.com
*facebook.com

Black domains patterns list:
*[0-9][0-9]-[0-9][0-9]-[0-9][0-9]*
*[0-9][0-9].[0-9][0-9].[0-9][0-9]*
*[0-9][0-9][0-9]-[0-9][0-9][0-9]-[0-9][0-9][0-9]*
*[0-9][0-9][0-9].[0-9][0-9][0-9].[0-9[0-9]][0-9]*
dsl|broadband|hsd
dynamic|static|ppp|dyn-ip|dial-up

SUCCESS: Gathering of server wide information complete.

This is the logfile output for on delived E-Mails:

Jun 1 18:57:13 mail postfix/smtpd[1185032]: C358024985: milter-reject: DATA from mout.kundenserver.de[212.227.126.130]: 451 4.7.1 Service unavailable - try again later; from=<SRS0=BB6S=BV=exampledomain1.tld=[email protected]> to=<[email protected]> proto=ESMTP helo=<mout.kundenserver.de>
Jun 1 18:57:13 mail postfix/smtpd[1185034]: C471C249C9: milter-reject: DATA from mout.kundenserver.de[212.227.126.130]: 451 4.7.1 Service unavailable - try again later; from=<SRS0=BB6S=BV=exampledomain1.tld=[email protected]> to=<[email protected]> proto=ESMTP helo=<mout.kundenserver.de>
Jun 1 19:02:17 mail postfix/smtpd[1188393]: 7C01A2497C: milter-reject: DATA from mout.kundenserver.de[212.227.126.131]: 451 4.7.1 Service unavailable - try again later; from=<SRS0=BB6S=BV=exampledomain1.tld=[email protected]> to=<[email protected]> proto=ESMTP helo=<mout.kundenserver.de>
Jun 1 19:02:19 mail postfix/smtpd[1188395]: CF30B24909: milter-reject: DATA from mout.kundenserver.de[212.227.126.187]: 451 4.7.1 Service unavailable - try again later; from=<SRS0=BB6S=BV=exampledomain1.tld=[email protected]> to=<[email protected]> proto=ESMTP helo=<mout.kundenserver.de>
Jun 1 19:09:50 mail postfix-local[1192125]: A1EA02408F: from=<SRS0=BB6S=BV=exampledomain1.tld=[email protected]>, to=<[email protected]>, dirname=/var/qmail/mailnames
Jun 1 19:09:51 mail postfix/pipe[1192124]: A1EA02408F: to=<[email protected]>, relay=plesk_virtual, delay=0.73, delays=0.43/0/0/0.3, dsn=2.0.0, status=sent (delivered via plesk_virtual service)

Or is it possible that there are problems because SRS uses the domain "@srs2.kundenserver.de"?

Thanks for your help
Patrick

 

[Peter Debik]

The log excerpts shows several email process ids. Is your question about A1EA02408F? Could you please try to grep all log entries related to that? The ones that you are showing are only explaining that a mail that was sent to [email protected] was successfully delivered to [email protected]. So far I cannot see an issue with that.

 

[gnilebein]

The log file excerpt concerns exactly this email.

The IDs C358024985,C471C249C9,7C01A2497C and CF30B24909 were the delivery attempts which were blocked by greylisting.

The ID A1EA02408F was the successful delivery attempt at the end.

The actual sender was [email protected].

Background: In these emails alarms for our local fire department are transmitted. These must not be delayed. Therefore we need the greylisting exception.

 

[Peter Debik]

At this time I still do not get what the actual question is. Are you saying that a mail sender domain that is whitelisted is still processed by the greylist? Could you please provide proof for that? Because from the information given above, this cannot be seen.

 

[gnilebein]

Exactly, we have a global whitelist entry for *@exampledomain1.tld and [email protected] still seems to be greylisted.

 

[Peter Debik]

Can you please show a log excerpt where this becomes visible? The log excerpt from above does not show it.

 

[gnilebein]

Jun 1 18:57:13 mail postfix/smtpd[1185032]: C358024985: milter-reject: DATA from mout.kundenserver.de[212.227.126.130]: 451 4.7.1 Service unavailable - try again later; from=<SRS0=BB6S=BV=exampledomain1.tld=[email protected]> to=<[email protected]> proto=ESMTP helo=<mout.kundenserver.de>
Jun 1 18:57:13 mail postfix/smtpd[1185034]: C471C249C9: milter-reject: DATA from mout.kundenserver.de[212.227.126.130]: 451 4.7.1 Service unavailable - try again later; from=<SRS0=BB6S=BV=exampledomain1.tld=[email protected]> to=<[email protected]> proto=ESMTP helo=<mout.kundenserver.de>
Jun 1 19:02:17 mail postfix/smtpd[1188393]: 7C01A2497C: milter-reject: DATA from mout.kundenserver.de[212.227.126.131]: 451 4.7.1 Service unavailable - try again later; from=<SRS0=BB6S=BV=exampledomain1.tld=[email protected]> to=<[email protected]> proto=ESMTP helo=<mout.kundenserver.de>
Jun 1 19:02:19 mail postfix/smtpd[1188395]: CF30B24909: milter-reject: DATA from mout.kundenserver.de[212.227.126.187]: 451 4.7.1 Service unavailable - try again later; from=<SRS0=BB6S=BV=exampledomain1.tld=[email protected]> to=<[email protected]> proto=ESMTP helo=<mout.kundenserver.de>
Jun 1 19:09:50 mail postfix-local[1192125]: A1EA02408F: from=<SRS0=BB6S=BV=exampledomain1.tld=[email protected]>, to=<[email protected]>, dirname=/var/qmail/mailnames
Jun 1 19:09:51 mail postfix/pipe[1192124]: A1EA02408F: to=<[email protected]>, relay=plesk_virtual, delay=0.73, delays=0.43/0/0/0.3, dsn=2.0.0, status=sent (delivered via plesk_virtual service)

As written befor the log above shows that issue. The IDs C358024985,C471C249C9,7C01A2497C and CF30B24909 are blocked by milter (no details available in Logfile). And after round about 10 minutes the mail was accepted with ID A1EA02408F. Is there a way to get more information why the mail first got rejected?

 

[danami]

Greylisting has it's own whitelisting tools. Example:

plesk bin grey_listing --update-server -domains-whitelist add:"mail.example.com"

Remember that you are whitelisting the client RDNS record of the connecting email server not an email address.

 

[gnilebein]

Thank you for the support. I assumed that a global whitelist also works globally and is also used for greylisting. I will now continue to observe and test this.

 

[mow]

Or is it possible that there are problems because SRS uses the domain "@srs2.kundenserver.de"?

Yes.