HowTo/ Hint: Spamassassin getting blocked due too many queries

[knebb]

Hi,

I have Unbound running on my OPNSense and a public mailserver with spamassassin behind.

I noticed log messages on my mailserver like this:

Code: [Select]

Jun 11 06:16:23 net spamd[9635]: check: dns_block_rule URIBL_BLOCKED hit, creating /root/.spamassassin/dnsblock_multi.uribl.com (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny multi.uribl.com" to disable queries)
Jun 11 06:16:23 net spamd[9635]: check: dns_block_rule RCVD_IN_ZEN_BLOCKED_OPENDNS hit, creating /root/.spamassassin/dnsblock_zen.spamhaus.org (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny zen.spamhaus.org" to disable queries)
Jun 11 06:30:12 net spamd[9635]: check: dns_block_rule URIBL_BLOCKED hit, creating /root/.spamassassin/dnsblock_multi.uribl.com (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny multi.uribl.com" to disable queries)
Jun 11 08:00:35 net spamd[9635]: check: dns_block_rule RCVD_IN_VALIDITY_CERTIFIED_BLOCKED hit, creating /root/.spamassassin/dnsblock_sa-trusted.bondedsender.org (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny sa-trusted.bondedsender.org" to disable queries)
Jun 11 08:00:35 net spamd[9635]: check: dns_block_rule RCVD_IN_VALIDITY_SAFE_BLOCKED hit, creating /root/.spamassassin/dnsblock_sa-accredit.habeas.com (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny sa-accredit.habeas.com" to disable queries)
Jun 11 08:00:35 net spamd[9635]: check: dns_block_rule RCVD_IN_VALIDITY_RPBL_BLOCKED hit, creating /root/.spamassassin/dnsblock_bl.score.senderscore.com (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny bl.score.senderscore.com" to disable queries)All with different but similar error messages.
Initially I did not have unbound configured but used some default open DNS servers.

Doing a search for the above errors lead into "install a local resolver like unbound". So did I. Same result, just less frequent.

For those who have similar issues, here's the solution.

The root cause is the blacklist queries are coming from very high frequent nameservers like Google (1.1.1.1) or Quad (9.9.9.9) which I had configured as forwarder. And the blacklists saw the queries only from these IPs and blocked them due to high volume.
I noticed this by doing a dig command:

Code: [Select]

root@netp:/# dig @opnsense 2.0.0.127.multi.uribl.com txt +short
"127.0.0.1 -> Query Refused. See http://uribl.com/refused.shtml for more information [Your DNS IP: 172.70.241.83]"
So this revealed a Cloudflare IP. But where did it come from?

In my Unbound I had configured forward servers. So my Unbound forwarded all queries to the high volume DNS servers, too.

Obviously using a local cache did not help here.

Finally I configured my Unbound to NOT use any forwarders - or use the local ISP DNS servers.
Once done, the above messages went away and I am back to proper spam protection.

Just in case it helps for some guys searching for the same issue.

/KNEBB

[bartjsmit]

Spammers are moving in on blacklists https://www.theregister.com/2024/06/07/sorbs_closed/

Caveat nuntius

Bart...