postscreen & Spammails

[sebastian at debianfan.de]

Hallo zusammen,

in meiner postscreen-Konfiguration scheint noch Optimierungsbedarf zu 
bestehen.

Mir ist aufgefallen, dass eine Mail als Spam von Spamassassin erkannt wurde:

Hierbei haben beispielsweise auch zen.spamhaus.org und surbl.org "gezogen".

Im Postfix-Logfile steht:

Oct  7 13:38:02 debian postfix/postscreen[1448]: CONNECT from 
[185.140.108.86]:35768 to [xxx.xxx.xxx.xxx]:25
Oct  7 13:38:02 debian postfix/dnsblog[1456]: addr 185.140.108.86 listed 
by domain free.v4bl.org as 127.0.0.3
Oct  7 13:38:02 debian postfix/dnsblog[1457]: addr 185.140.108.86 listed 
by domain bl.spamcop.net as 127.0.0.2
Oct  7 13:38:02 debian postfix/dnsblog[1451]: addr 185.140.108.86 listed 
by domain dnsbl-1.uceprotect.net as 127.0.0.2
Oct  7 13:38:02 debian postfix/dnsblog[1459]: addr 185.140.108.86 listed 
by domain dnsbl.inps.de as 127.0.0.2
Oct  7 13:38:02 debian postfix/dnsblog[1453]: addr 185.140.108.86 listed 
by domain zen.spamhaus.org as 127.0.0.2
Oct  7 13:38:02 debian postfix/dnsblog[1453]: addr 185.140.108.86 listed 
by domain zen.spamhaus.org as 127.0.0.3
Oct  7 13:38:02 debian postfix/dnsblog[1452]: addr 185.140.108.86 listed 
by domain b.barracudacentral.org as 127.0.0.2
Oct  7 13:38:02 debian postfix/postscreen[1448]: DNSBL rank 13 for 
[185.140.108.86]:35768
Oct  7 13:38:02 debian postfix/smtpd[1458]: connect from 
weight.zunlongkk.com[185.140.108.86]
Oct  7 13:38:02 debian postgrey[470]: action=pass, reason=triplet found, 
delay=962, client_name=weight.zunlongkk.com, 
client_address=185.140.108.86, 
sender=thiemo7t1xmaegerhard at zunlongkk.com, 
recipient=kontakt at meinedomain.de-nw.de
Oct  7 13:38:02 debian postfix/smtpd[1458]: A8FF6C0D36: 
client=weight.zunlongkk.com[185.140.108.86]
Oct  7 13:38:02 debian postfix/cleanup[1465]: A8FF6C0D36: 
message-id=<jjck7p2nmrqcdm2fsnra07pgade774f8z at zunlongkk.com>
Oct  7 13:38:02 debian postfix/qmgr[1133]: A8FF6C0D36: 
from=<thiemo7t1xmaegerhard at zunlongkk.com>, size=4187, nrcpt=1 (queue active)
Oct  7 13:38:02 debian spamd[1071]: spamd: connection from localhost 
[::1]:51661 to port 783, fd 6
...und hier wird weitertransportiert in das Postfach

Wie ich postscreen interpretiere, ist die IP in vielen Listen enthalten 
und der Postscreen-Rank ist 13.

main.cf:

postscreen_dnsbl_threshold = 3
postscreen_dnsbl_sites = zen.spamhaus.org*3,
bl.spamcop.net*2,
dnsbl.inps.de*2,
dnsbl-1.uceprotect.net*2,
dnsbl.sorbs.net*2,
bl.blocklist.de*2,
free.v4bl.org*2,
multi.surbl.org*2,
b.barracudacentral.org*2,
psbl.surriel.com*1,

postscreen_enforce_tls = $smtpd_enforce_tls
postscreen_use_tls = $smtpd_use_tls


master.cf:
smtp      inet  n       -       n       -       1 postscreen
smtpd pass - - n - - smtpd -o content_filter=spamassassin



Ich vermute den Fehler in der main.cf - fehlt hier noch etwas?

gruß

Sebastian