4

I'm finding quite a few of these types of messages in my postfix log:

17:40:55 smtpd: warning: 34.77.82.185.b.barracudacentral.org: RBL lookup error: Host or domain name not found. Name service error for name=34.77.82.185.b.barracudacentral.org type=A: Host not found, try again
17:41:05 smtpd: warning: 34.77.82.185.hostkarma.junkemailfilter.com: RBL lookup error: Host or domain name not found. Name service error for name=34.77.82.185.hostkarma.junkemailfilter.com type=A: Host not found, try again
18:15:02 smtpd: warning: ptmail1.patrontechnology.com.dbl.spamhaus.org: RBL lookup error: Host or domain name not found. Name service error for name=ptmail1.patrontechnology.com.dbl.spamhaus.org type=A: Host not found, try again
18:40:27 smtpd: warning: 177.141.213.134.zen.spamhaus.org: RBL lookup error: Host or domain name not found. Name service error for name=177.141.213.134.zen.spamhaus.org type=A: Host not found, try again

I am trying to understand if there is something wrong with my configuration or if these messages are (as I have read non-authoritatively elsewhere) merely a slightly weird way of indicating that the sender is not black-listed by the given service. Certainly some (maybe all) of the emails which generate these messages are genuine and are indeed forwarded correctly and successfully by postfix.

These are the relevant lines of my smtp_recipient_restrictions:

reject_rbl_client zen.spamhaus.org
reject_rbl_client b.barracudacentral.org
reject_rbl_client hostkarma.junkemailfilter.com=127.0.0.2
reject_rhsbl_helo dbl.spamhaus.org
reject_rhsbl_sender dbl.spamhaus.org
reject_rhsbl_reverse_client dbl.spamhaus.org
1

This is not normal behavior, it seems like postfix cannot reach the blacklist servers.

From your machine, try the following command: (nslookup is often already installed or can be installed by getting dnsutils or a similar package.)

nslookup 127.0.0.2.zen.spamhaus.org

The result should be something along the lines of

Non-authoritative answer:
Name:    127.0.0.2.zen.spamhaus.org
Address: 127.0.0.11

If the command times out, the blacklist DNS server is not reachable from your server. Should that be the case, check if other DNS queries work as expected (e.g. nslookup unix.stackexchange.com).

I suspect that either a firewall blocks access to those DNS servers, or your server is being blocked for sending too many requests. The latter seems unlikely, considering the far-spaced timestamps in your log. However, it might be that all your queries are sent through your ISP's DNS server. That server probably reaches the limit imposed by the blacklist providers, causing it to be blocked.

You can check for this by asking a spamhaus nameserver directly:

nslookup 127.0.0.2.zen.spamhaus.org a.ns.spamhaus.org

If this succeeds, but the lookup over you default service failed, it means that your default resolver is blocked by spamhaus. Install a caching DNS server in that case.

  • 1
    Thanks tarleb for your detailed answer. I am already running bind locally as a cacheing DNS server. When I do either of your suggested nslookups I get a correct response (i.e. whether via bind or directly to a.ns.spamhaus.org). I don't think my RBL lookups are always failing, the log messages are not regular enough for that. I have written some code to run the nslookup check within a couple of minutes of any RBL lookup error occurring and will see if nslookup then reports an error. – gogoud Jan 15 '16 at 17:11
  • 1
    So I now have a few examples. So far, the errors seem to occur at about the same time each day (c.6am-7am). When, shortly afterwards (say a minute) I run nslookup to the same address via my local bind DNS server, I occasionally get 'SERVFAIL' response (tho more often 'NXDOMAIN'), when I run it direct to a.ns.spamhaus.org I always get 'NXDOMAIN' response. I suspect that this 'SERVFAIL' response might be a sign that there is something going wrong in my bind though it since it usually works okay I have no idea what. – gogoud Jan 18 '16 at 6:46
  • I have bind 9.9.5-3ubuntu0.6-Ubuntu which is the standard release in Ubuntu 14.04LTS. But I now see that in the release notes for bind 9.9.6 it says 'Fixed a bug that caused SERVFAILs when using RPZ on a system configured as a forwarder. [RT #36060]' - I wonder if this could be it? – gogoud Jan 18 '16 at 6:56
  • @gogoud I'm a total noob when it comes to bind. Maybe a separate question would help? Interesting problem though, thanks for keeping us updated. – tarleb Jan 18 '16 at 7:03
  • To update this, I am now using bind 9.10.3 (on Ubuntu 16.04) and I don't seem to see these errors any more. So I am guessing the problem was caused by a bug in earlier versions of bind. – gogoud Oct 4 '16 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.