SMTP Stops when MAPS is on

[tema]

I had the same problem with SMTP reporting down all the time when I configured MAPS.
I went through the process of elimination and found it was...

relays.ordb.org

...giving the problem. Once I removed it from the list, SMTP was back up and running.
My MAPS zone list now looks like this:


bl.spamcop.net;blackholes.mail-abuse.org;list.dsbl.org;cbl.abuseat.org;dnsbl.ahbl.org;rhsbl.ahbl.org;ircbl.ahbl.org;t1.dnsbl.net.au;combined.njabl.org;bhnc.njabl.org;dnsbl.sorbs.net;sbl-xbl.spamhaus.org

 

[phatPhrog]

Fixed me up

Originally posted by webhilfe
have you check the Maps-Zones? I had the same problem for any time. You must delete not working adresses from the list.

Here are my Maps-List:

• relays.mail-abuse.org;vrbl.xtreme-host.com;http.dnsbl.sorbs.net;misc.dnsbl.sorbs.net

Was having the same problem. Changed my maps to yours and restarted SMTP with no problems.

BTW - was using:

sbl-xbl.spamhaus.org;bl.spamcop.net;relays.ordb.org;dnsbl.sorbs.net;cbl.abuseat.org;multihop.dsbl.org

so I guess one of those is no longer good for us.

Thanks for the info.

 

[philburress]

Had the exact same problem. The only one that worked for me was:

bl.spamcop.net

All of the others were down or unreachable.

 

[phatPhrog]

MAPS down after 8.0.1 update

whew. AFter updating my current 8.0.1 it seems MAPS pretty much bogs down or causes SMTP to simply stop running.

After disabling MAPS, my mail runs smoother, spamassassin works better and my local client and can send/receive much faster.

 

[KrazyBob]

It seems that SMTP fails on 8.1.0 as well running in top of a VE. I couldn't find the answer here and guessed that by typing /usr/local/psa/bin/mailserver.sh --set-maps-status false I could turn off MAPS. I was using spamhaus and still don't know why the failure.

 

[nickpick]

You must all be aware that recently the following hostnames no longer work:
sbl-xbl.spamhaus.org
multi.surbl.org

If you still use them, you will have the problems.

Also notice this when adding Rt0 to your /etc/xinetd.d/smtp_psa
You must do that AFTER you changed the maps servers. Plesk always overwrites your /etc/xinetd.d/smtp_psa when you change the maps servers through the Plesk interface.

(and don't forget to restart xinetd after editing /etc/xinetd.d/smtp_psa

 

[calderwood]

Spamhaus still has sbl-xbl up

I just checked Spamhaus and they still have the following listed:

sbl.spamhaus.org 127.0.0.2 Direct UBE sources, verified spam services and ROKSO spammers

xbl.spamhaus.org 127.0.0.4-6 Illegal 3rd party exploits, including proxies, worms and trojan exploits

SBL+XBL sbl-xbl.spamhaus.org 127.0.0.2-6 Combined zone to reduce queries. Includes both SBL and XBL zones

Go to http://www.spamhaus.org/sbl/howtouse.html

 

[nickpick]

Yes, I see it...

For some reason last weekend I had problems with a Plesk 8 server because the sbl-xbl.spamhaus.org was not accessible.

I tested this manually.

After removing this host from the MAPS list, the problem got resolved.

This indicates how fragile this MAPS thing is. An inaccessible maps server causes the Plesk email to go down...

 

[calderwood]

Spam assassin bug

Also, there is a bug (#3997) in versions of SpamAssassin older than 3.1 where the responses to DNS queries occasionally get mixed up, resulting in very rare false positives (non-spam tagged as spam).

Check http://www.surbl.org/

 

[calderwood]

Spam *** goes down

I've been tracking an event on my server where Spam Assassin shuts down about every second day at around 8.00-8.30AM Not sure what is causing it, but it always hapens within that half-hour time block.

My present MAPS list is:
bl.spamcop.net;sbl-xbl.spamhaus.org;cbl.abuseat.org;combined.rbl.msrbl.net;dnsbl.njabl.org;nomail.rhsbl.sorbs.net;http.dnsbl.sorbs.net;misc.dnsbl.sorbs.net;smtp.dnsbl.sorbs.net

 

[DCNet_James]

Spamhaus is functioning just fine. We employ the following RBL's on our border relay mail services.
bl.spamcop.net
sbl-xbl.spamhaus.org
list.dsbl.org
combined.njabl.org

I do not recommend using SORBS as I've had a lot of false positives with them. The above 4 are very popular, well respected and we experience a very low false positive count. Ultimately the use of an RBL is very resource heavy with PSA/Qmail. With so much going on with PSA as it is, I would highly recommend using an external border mail service or appliance to handle the spam load.

We operate such a service that works well with PSA if anyone is interested.

Thanks,
James

 

[calderwood]

List

Thanks - I'll change our list and remove the RBL and see if that solves the problem.

David

 

[calderwood]

combined.njabl.org not used any more

After adding combined.njabl.org I found we were getting client problems sending. After checking it out I traced to to combined.njabl.org which is no longer updated. Here is a message from theor website:

If you currently use dynablock.njabl.org we recommend you switch immediately to pbl.spamhaus.org. If you currently use combined.njabl.org, we recommend you add pbl.spamhaus.org to the list of DNSBLs you use. You may also want to consider using zen.spamhaus.org, which is a combination zone consisting of Spamhaus's SBL, XBL, and PBL zones.

 

[nickpick]

maps hosts

Wouldn't it be a great idea if we could have some kind of sticky thread here.
And then put MAPS hosts problems in this thread?
Because this problem-maps-servers seem to cause us problems again and again.

What do you all think?

 

[calderwood]

MAPS Thread

Yes, I would agree that a MAPS thread would be great. The fact that there are so many lists out there and the quality and reliability of them seems to vary to a wide degree, it would be nice to have a central place to go.

 

[CruzMark]

Originally posted by ianotr
We are having the same problems. If we turn maps on then the smtp server slows down hugely.
The problem apprears to be in maps itself or a setting within the server. This has happened on 2 servers and both at approximately the same time. We have tried to activate maps with only sbl-xbl.spamhaus.org and still the same problem.

Any input is appreciated.

If your site has enough traffic, spamhaus could be blocking your IP from doing queries at their servers. This happened to us last week, and we had to subscribe to their data feeds.

If they block you, it will really slow things down, as each message will run through your resolver trying to lookup the address.

 

[livid]

So what is the current list of MAPS you are all using?

 

[calderwood]

MAPS List

Originally posted by livid
So what is the current list of MAPS you are all using?

I'm using:
bl.spamcop.net;sbl-xbl.spamhaus.org;cbl.abuseat.org;list.dsbl.org

 

[nickpick]

I am currently only using sbl-xbl.spamhaus.org
But that is not sufficient.

 

[DCNet_James]

I would never rely solely on RBL lists, because they do tarpit your requests if you make too many requests as someone already mentioned. I would employ other techniques such as smtp delays, maintaining your own blacklists, using 1 or 2 MAPS lists that are reliable not a bunch, rejection if PTR record does not exist for a connecting host, malformed HELO/EHLO checks, etc etc etc, and of course house keeping.

Of course the Plesk server cannot do all of these very easily w/o a lot of hacking at qmail.

Spamcop and Spamhaus SBL-XBL are my 2 favorites since we are on the topic. On my PSA servers I only employ 1 of the 2 just to keep connection delays from clients to a minimum. All of my inbound SMTP passes through a border mail system first and is then host routed to my PSA boxes. This way, they take the abuse of inbound and PSAs are not public facing other than for relaying by clients.