Issue Plesk Mail Server keeps getting blacklisted

[DanielJ]

Hello Pleskians!
I hope somebody can point me into the right direction.

As mentioned we got a server with plesk obsidian (latest micro update) on CentOS 7 with Postfix as mailserver.

We setup SPF, DKIM and DMARC to get our e-mail deliverability up. But unfortunaly we keep getting blacklisted.

According to this article: Many email messages are sent from PHP scripts on a Plesk server. How to find domains on which these scripts are running if Postfix is used? we verified that no php script is sending spam.

Also we reached out to Spamhaus Zen. They told us that the server is sending helo/ehlo with multiple domains that are NOT hosted by us.

We fighting this issue for nearly 2 months now and running out of ideas.

Edit:
Since this post got approved i want to share additional infos:

We checked via mxtoolbox.com the email deliverability, rDNS Records, and HELO / EHLO names. Everything seems fine.
We are also part of the SDNS and JMRP (Microsofts Deliverability Center) and also it seems fine (green). No unusual data.

On this hosts is a single online shop which sends not more then 20 mails in an hour.
We activated the outgoing mail limit (30 per hour) and no mail address reaches this limit.

We still getting relisted every 2 days.

Edit 2: (edited cause Peter Debik mentioned a possible fix that i forgot to mention)

We followed the instructions on https://www.abuseat.org/PleskAvoid.html and set Mail Server Settings to "send from domain ip addresses".
We took this a step further according to the plesk documentation and set this option to "send from specified ip address" and used the only ipv4 address for this server. Still doesn't fix the issue.

"Send from the specified IP address. You might want to use certain IPv4 and IPv6 addresses for all outgoing mail. Sending all mail from the specified address might be useful, for example, if the IP address of the mail server was added to a public black list, such as the Spamhaus or OpenBL lists. If you select None, outgoing mail will not be sent. "

Any help is appreciated.
Best wishes,
Daniel.

 

[Bitpalast]

GUI > Tools & Settings > Mail Server Settings

"Send from domain IP addresses and use domain names in SMTP greeting" must not be selected.

Instead, use

"Send from domain IP addresses"

Else Spamhaus will blacklist you, because you are sending with the same IP but different SMTP greetings (as they said).

 

[DanielJ]

Hello Peter!
thanks for your reply.

We already set this setting as suggested by spamhaus. I forgot to mention this earlier.

Thank you!

 

[Bitpalast]

Does that mean that your case is solved?

 

[DanielJ]

@Peter Debik
no the issue still persists. updated my post accordingly.

 

[DanielJ]

Hello Pleskians,

any other thoughts on this?
I mean i would have opened a ticket but our license was bought by a reseller who just run a clamav scan and charge us 4 hours of work without any solution...

As always.. any help is appreciated!
Thanks.

 

[LukasB]

Can you say where you get "blacklisted"? Free Mails like @yahoo.de/gmail.com/t-online.de/.. or other "own" Mail-Server with Spamfilter?

 

[DanielJ]

hello @LukasB

we get listed on spamhaus zen cbl and sbl repeatly.
also Microsoft got us listed (hotmail.com, live.com and outlook.com).

freenet.de is referring to a broken/missing rDNS Record - our rDNS Entry is fine.

We tried a service like Newsletters spam test by mail-tester.com and get 10/10 so i really can't find a single reason why we get relisted...

Thanks for your reply!

 

[Bitpalast]

Have you protected your temporary directory or partition (/tmp) against execution of scripts located in /tmp?
Can you check whether standalone smtp servers can be found in the process list that should not be there?

 

[ChristophRo]

Does your server also use an IPv6 address? if yes, is the PTR for the IPv6 address correct as well?

As one can assume that Spamhaus gave you a legit answer, we need to look into the technical possibilities on how to send emails from your server with foreign/forged helo.
As this cannot happen when your postfix or exim mailserver sends these emails, we are left with a service or script (php/perl) on your server that transmits these messages directly via SMTP. (and does not use the sendmail method)

If you are interested in finding out which website/user is sending these emails, you can try to log all outbound connections to tcp port 25 (we can ignore all other ports in this case) with the following iptables rules:

iptables -A OUTPUT --protocol tcp --dport 25 --jump LOG --log-uid

This will log the connections in the syslog of your server, including the UID of the process. (and with that you will find the user and the website)

If your postfix/exim sends alot of emails and you want to exclude it from logging, you can use

iptables -A OUTPUT --match owner --uid-owner postfix --protocol tcp --dport 25 --jump ACCEPT
iptables -A OUTPUT --protocol tcp --dport 25 --jump LOG --log-uid

(replace the --uid-owner postfix with the username of the postfix/exim process on your system)


If you are finished and want to delete these rules, just execute them again and replace the -A with -D

 

[DanielJ]

Hello @Peter Debik and @ChristophRo
Thanks for your reply!

I'll try this solutions and reply once i get more insights!
Have a nice day.

 

[DanielJ]

Hello Pleskians!
with these steps mentioned by @ChristophRo i was able to determine a malicious script in one of those subscriptions.

Now I see a lot of Mail produced by Postfix itself.

Feb 3 08:36:15 <hostname> kernel: IN= OUT=enp2s0 SRC=<host-ip> DST=217.72.192.67 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=14592 DF PROTO=TCP SPT=41865 DPT=25 WINDOW=316 RES=0x00 ACK RST URGP=0 UID=89 GID=89

I searched for this UID and it is Postfix. Thoses entrys repeat itself every few seconds. So i guess this isn't a customer who is writing mails in this frequency
Any other thougths or ideas how to hunt the source of this behavior down?

Anyway, so far i'm really happy with the help in this forum. Thank you guys so much!