Zimbra 554 5.7.1 error, RCPT error

[nikola011]

Hi Guys,

From multiple corporate mail servers, ours collaborators, we don't get emails.

These servers are hosted by private emails companies.

We receiving mails from Gmail, and from other emails servers.

The mutual thing for these mail servers from which we don't receive mail are: No TLS support.

Those emails are very important to us, accountant, supplier.

X.X.X.X - collaborator IP
Y.Y.Y.Y - out IP

Code: Select all

Jul 29 06:29:57 zimbra postfix/postscreen[27305]: CONNECT from [X.X.X.X]:36450 to [Y.Y.Y.Y]:25
Jul 29 06:29:57 zimbra postfix/postscreen[27305]: PASS OLD [X.X.X.X]:36450
Jul 29 06:29:57 zimbra postfix/smtpd[27306]: connect from mx1.mail.collaboratorX.rs[X.X.X.X]
Jul 29 06:29:57 zimbra postfix/smtpd[27306]: Anonymous TLS connection established from mx1.mail.collaboratorX.rs[X.X.X.X]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
Jul 29 06:29:57 zimbra postfix/smtpd[27306]: NOQUEUE: filter: RCPT from mx1.mail.collaboratorX.rs[X.X.X.X]: <info@mail.collaboratorX.rs>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10026; from=<info@mail.collaboratorX.rs> to=<y@our.mail.rs> proto=ESMTP helo=<relay05.comtradecloud.com>
Jul 29 06:29:57 zimbra postfix/smtpd[27306]: warning: permit_tls_clientcerts is requested, but "smtpd_tls_ask_ccert = no"
Jul 29 06:29:57 zimbra postfix/smtpd[27306]: NOQUEUE: filter: RCPT from mx1.mail.collaboratorX.rs[X.X.X.X]: <info@mail.collaboratorX.rs>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<info@mail.collaboratorX.rs> to=<y@our.mail.rs> proto=ESMTP helo=<relay05.comtradecloud.com>
Jul 29 06:29:58 zimbra postfix/smtpd[27306]: NOQUEUE: reject: RCPT from mx1.mail.collaboratorX.rs[X.X.X.X]: 554 5.7.1 Service unavailable; Client host [X.X.X.X] blocked using xbl.spamhaus.org; from=<info@mail.collaboratorX.rs> to=<y@our.mail.rs> proto=ESMTP helo=<relay05.comtradecloud.com>
Jul 29 06:29:58 zimbra postfix/smtpd[27306]: disconnect from mx1.mail.collaboratorX.rs[X.X.X.X] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 rset=1 quit=1 commands=6/8

Second collaborator send mail with gmail to us, an error which he got when he try to sent email to us with his main mail.

Y.Y.Y.Y - out IP
Z.Z.Z.Z - collaborator 2 IP

Code: Select all

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  user1@our.mail.rs
    SMTP error from remote mail server after RCPT
TO:<user1@our.mail.rs>:
    host our.mail.rs [Y.Y.Y.Y]: 554 5.7.1 Service unavailable;
Client host [Z.Z.Z.Z] blocked using sbl.spamhaus.org; Error:
    open resolver;
https://www.spamhaus.org/returnc/pub/2400:cb00:124:1024::ac44:dc86

------ This is a copy of the message, including all the headers. ------

Plese could you help me with this.
Has this happened to you in the past 15 days?
Can i add an exception for them or do something?

Thank you very much
Best regards

[L. Mark Stone]

The collaborator’s IP address is listed by Spamhaus. They should find out why, fix the root cause, and then ask Spamhaus to delist them.

Most commonly, we see senders like that have suffered an exploit, so until they clean their system you don’t want to receive (infected?) e-mail from them anyway.

Hope that helps,
Mark

[nikola011]

Hi, Mark,

Thank you very much for join a topic. In the meantime, I was catch on something, the emails arrive if they are sent to the address list, but if they are sent directly to a colleague, or directly to me, the mail will be rejected. At this moment I don't know why Zimbra works like this, a former admin did not have this situation.

This log from mail on contributor is

Code: Select all

Error:
    open resolver;
https://www.spamhaus.org/returnc/pub/2400:cb00:124:1024::ac44:dc86

------ This is a copy of the message, including all the headers. ------

And https://www.spamhaus.org/returnc/pub/2400:cb00:124:1024::ac44:dc86 is

If you are viewing this page, you have likely sent an email that was not delivered to the recipient. In the resulting bounced email message you have found and clicked this link: https://www.spamhaus.org/returnc/pub/2400:cb00:124:1024::ac44:dc86

The problem doesn’t relate to your email set-up.

Why has my email not been delivered?
The problem is with the recipient’s email server configuration.
This is not due to an issue with your email set-up.
It is not because you are listed on one of our blocklists.

I'm not sure, maybe something is wrong with my mail server.
I will investigate further

Thank you very much
Best regard
Nikola

[nikola011]

Hi Guys,

I got bigger problem with mail server. Now for big bank which we use, occasionally our server reject emails. This emails is extreme important, statements with payments, and the like this.

And I must allow recieving these emails.

Colleagues in finance sector cannot work without it.

For this bank, spamhouse is clear, not banned.

When I checked their mail server, not everything is 100 percent setup, such as TLS etc.

How can I add accept list for this log? Could you give me hint, please?

I need add accept list for smtp-amavis or postfix?

I think this part is key .

Aug 4 06:31:36 zimbra postfix/smtpd[1330]: NOQUEUE: reject: RCPT from mx5.mail.bancainserbia.rs[X.X.X.X]: 554 5.7.1 Service unavailable; Client host [X.X.X.X] blocked using sbl.spamhaus.org; from=<info@mail.bancainserbia.rs> to=<ouraddresslist@isp.ourmailserver.rs> proto=ESMTP helo=<relay09.somecloudinserbia.com>

The entire log.

Code: Select all

Aug  4 06:31:30 zimbra postfix/postscreen[1329]: CONNECT from [X.X.X.X]:36570 to [Y.Y.Y.Y]:25
Aug  4 06:31:31 zimbra postfix/smtps/smtpd[32380]: Anonymous TLS connection established from unknown[Z.Z.Z.Z]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Aug  4 06:31:36 zimbra postfix/postscreen[1329]: PASS OLD [X.X.X.X]:36570
Aug  4 06:31:36 zimbra postfix/smtpd[1330]: connect from mx5.mail.bancainserbia.rs[X.X.X.X]
Aug  4 06:31:36 zimbra postfix/smtpd[1330]: Anonymous TLS connection established from mx5.mail.bancainserbia.rs[X.X.X.X]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
Aug  4 06:31:36 zimbra postfix/smtpd[1330]: NOQUEUE: filter: RCPT from mx5.mail.bancainserbia.rs[X.X.X.X]: <info@mail.bancainserbia.rs>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10026; from=<info@mail.bancainserbia.rs> to=<ouraddresslist@isp.ourmailserver.rs> proto=ESMTP helo=<relay09.somecloudinserbia.com>
Aug  4 06:31:36 zimbra postfix/smtpd[1330]: warning: permit_tls_clientcerts is requested, but "smtpd_tls_ask_ccert = no"
Aug  4 06:31:36 zimbra postfix/smtpd[1330]: NOQUEUE: filter: RCPT from mx5.mail.bancainserbia.rs[X.X.X.X]: <info@mail.bancainserbia.rs>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<info@mail.bancainserbia.rs> to=<ouraddresslist@isp.ourmailserver.rs> proto=ESMTP helo=<relay09.somecloudinserbia.com>
Aug  4 06:31:36 zimbra postfix/smtpd[1330]: NOQUEUE: reject: RCPT from mx5.mail.bancainserbia.rs[X.X.X.X]: 554 5.7.1 Service unavailable; Client host [X.X.X.X] blocked using sbl.spamhaus.org; from=<info@mail.bancainserbia.rs> to=<ouraddresslist@isp.ourmailserver.rs> proto=ESMTP helo=<relay09.somecloudinserbia.com>
Aug  4 06:31:36 zimbra saslauthd[16258]: zmauth: authenticating against elected url 'https://zimbra.ourmailserver.rs:7073/service/admin/soap/' ...
Aug  4 06:31:36 zimbra postfix/smtpd[1330]: disconnect from mx5.mail.bancainserbia.rs[X.X.X.X] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 rset=1 quit=1 commands=6/8

Best regard and thanks a lot
Nikola

[L. Mark Stone]

Same issue: Your bank’s IP address has been listed by Spamhaus.

You won’t be the only one marking their email as Junk. It’s up to them to fix the issue that caused their IP to get listed in the first place.

If your bank has been hacked as the reason why their IP got listed, you likely don’t want to receive their emails. And maybe you also might want to use a different bank.

[nikola011]

Hi Mark,

Thank you very much for help, I really appreciate that. I have agreement with colleagues in financial sector, that they are going to sent request to bank for another way for sending reports, mail is curently unreliable.

I hope that they are ASAP solve this problem.

Changing the bank is a little bit problematic, but we will keep this on mind.

Thank you very much again, your info helps me.

Best regard
Nikola

[nikola011]

Hi Guys,

It's definitely my mail server problem, this morning we received emails from an new associate, and 2 hours ago the email from them was rejected.

The same error, This start happening when I was update mail server, also half hour ago, I got also one update.

White list is not solution, there is something other, but I cant figure out what.



Thanks a lot
Best regard
Nikola

[nikola011]

I got feedback from one Mail admin, this is their log

Code: Select all

 
from localhost [127.0.0.1]

----- The following addresses had permanent fatal errors -----
<user1@our.mailserver.rs>
(reason: 554 5.7.1 Service unavailable; Client host [X.X.X.X] blocked using
sbl.spamhaus.org; Error: open resolver;
https://www.spamhaus.org/returnc/pub/Y.Y.Y.Y)
<user2@our.mailserver.rs>
(reason: 554 5.7.1 Service unavailable; Client host [X.X.X.X] blocked using
sbl.spamhaus.org; Error: open resolver;
https://www.spamhaus.org/returnc/pub/Y.Y.Y.Y)

----- Transcript of session follows -----
... while talking to our.mailserver.rs.:
>>> DATA
<<< 554 5.7.1 Service unavailable; Client host [X.X.X.X] blocked using
sbl.spamhaus.org; Error: open resolver;
https://www.spamhaus.org/returnc/pub/Y.Y.Y.Y
554 5.0.0 Service unavailable
<<< 554 5.7.1 Service unavailable; Client host [X.X.X.X] blocked using
sbl.spamhaus.org; Error: open resolver;
https://www.spamhaus.org/returnc/pub/Y.Y.Y.Y
554 5.0.0 Service unavailable
<<< 554 5.5.1 Error: no valid recipients

There is a new thing

554 5.0.0 Service unavailable
<<< 554 5.5.1 Error: no valid recipients

[nikola011]

Hi Guys,

This is how the mail spam filter is set



Do you have any suggestion, because the number of emails that are not arriving has escalated

Thank you very much best regards
Nikola

[phoenix]

If you read the error message and then do an internet search you would have found this: https://www.spamhaus.org/returnc/pub/