Re: postscreen and Google
- /dev/rob0 opined on Monday 13-May-2013@06:06:27
> All the Google, Facebook, Yahoo, et c. outbounds as well as most ISPsThanks! That sounds very promising. I was hoping I could do something to pass *.google.com instead of the cidr map, but this sounds like it will be better.
> and legitimate bulk mailers are listed in the dnswl.org whitelist.
> Your best choice is to upgrade to postfix-2.11-20130512 and use the
> new feature (see Wietse's thread about it yesterday.)
The brain is an amazing organ, it works every second of every day
from before we're even born right up until the instant we fall in
- On Tue, May 14, 2013 at 12:00:00AM -0600, LuKreme wrote:
> /dev/rob0 opined on Monday 13-May-2013@06:06:27So far so good, here; now running the revised snapshot
> > All the Google, Facebook, Yahoo, et c. outbounds as well as
> > most ISPs and legitimate bulk mailers are listed in the
> > dnswl.org whitelist. Your best choice is to upgrade to
> > postfix-2.11-20130512 and use the new feature (see Wietse's
> > thread about it yesterday.)
> Thanks! That sounds very promising.
postfix-2.11-20130513. Mail (and spam) from Google gets through
postscreen as soon as the DNS[BW]L score is computed. Not just
Google: I have lots of others with a dnswl.org hit and "PASS NEW".
> I was hoping I could do something to pass *.google.com insteadThis is not possible because postscreen does not look up a client's
> of the cidr map, but this sounds like it will be better.
http://rob0.nodns4.us/ -- system administration and consulting
Offlist GMX mail is seen only if "/dev/rob0" is in the Subject:
- Wietse Venema opined on Monday 13-May-2013@07:22:03
>> I have postscreen running well after having it run in non-blocking
>> mode for awhile, but I continue to see “new" google servers every
> Don't enable the "after 220" tests, or wait until whitelistingAfter looking at my log files I’ve disabled all the “after 220” test for now. Looking forward to the stable whitelisting support in the 2.11 when that’s released.
> is stable. Given that Google has many servers, manual whitelisting
> is not a long-term solution.
And Super Heroes come to feast
To taste the flesh not yet deceased
And all I know is still the beast is feeding.
> > Don't enable the "after 220" tests, or wait until whitelistingpostscreen 2.11 DNS-based whitelisting is finished. It also eliminates
> > is stable. Given that Google has many servers, manual whitelisting
> > is not a long-term solution.
> After looking at my log files I?ve disabled all the ?after 220?
> test for now. Looking forward to the stable whitelisting support
> in the 2.11 when that?s released.
most of the postscreen_greet_wait delay for whitelisted sites.
My settings are relatively generous, but they don't have to stop
all spam. I still rely on smtpd_mumble_restrictions and so on.
postscreen_dnsbl_action = enforce
postscreen_dnsbl_sites = zen.spamhaus.org*2 bl.spamcop.net*1
postscreen_dnsbl_threshold = 2
postscreen_dnsbl_ttl = 1h (the default)
postscreen_dnsbl_whitelist_threshold = -1