Solution: Whitelist for Postfix if using RBLs

[bertie_uk]

If you are using RBLs (such as zen.spamhaus.org) to block spam, the whitelist method in the Wiki does not work. This is because the wiki method is for spamassasin not postfix.

Postfix will check incoming messages against the RBL first, and allow/reject accordingly. So if you have a sender listed on a RBL, you need to whitelist them in Postfix.

Using this post: How To Whitelist Hosts/IP Addresses In Postfix | HowtoForge - Linux Howtos and Tutorials

I came up with a method to do this in Zimbra. {commands in italics}

Login and change to zimbra user

vi /opt/zimbra/conf/postfix_rbl_override
list all IP addresses or host names (one per line!) that you want to whitelist:

1.2.3.4 OK
1.2.3.5 OK
mail.freemailer.tld OK

postmap /opt/zimbra/conf/postfix_rbl_override

vi /opt/zimbra/conf/postfix_recipient_restrictions.cf

under:
reject_unauth_destination
add:
check_client_access hash:/opt/zimbra/conf/postfix_rbl_override

e.g.:

reject_unauth_destination
check_client_access hash:/opt/zimbra/conf/postfix_rbl_override
reject_unlisted_recipient

zmmtactl restart

Each time you add a new one, you need to do the postmap command then zmmtactl restart

Bertie

[phoenix]

Thanks for posting this, would you mind adding it to the wiki as that's a more appropriate place for this kind of article.

[ewilen]

Thanks from me, too. This will come in handy. Also, I've inserted a cross-reference to this thread in Bug 43956 - RFE: MTA-level whitelisting.

[bertie_uk]

Updated to Wiki here: Improving Anti-spam system - Zimbra :: Wiki

Bertie

[phoenix]

Originally Posted by bertie_uk

Updated to Wiki here: Improving Anti-spam system - Zimbra :: Wiki

Thanks for doing that.

[fcash]

Originally Posted by bertie_uk

under:
reject_unauth_destination
add:
check_client_access hash:/opt/zimbra/conf/postfix_rbl_override

e.g.:

reject_unauth_destination
check_client_access hash:/opt/zimbra/conf/postfix_rbl_override
reject_unlisted_recipient

You should put the override right above the item you are overriding, and not just anywhere above.

Each time you add a new one, you need to do the postmap command then zmmtactl restart

Why the "zmmtactl restart"? Postfix doesn't need to be restarted to pick up changes in a hashed db. Running postmap on the file is enough to alert postfix that there are changes and to reload the db.