Thank you for all the tips/pointers.
For now, I switched mx_check to DNS-only mode.
Regards
On 15/10/2026 17:28, Vsevolod Stakhov wrote:
On 14/10/2026 17:55, Stuart Henderson wrote:
On 2026/10/14 18:47, sst via mailop wrote:
hi
I was surprised to find an AbuseIPDB.com report for my server, about
a brute
force attempt.
Oct 6 11:51:49 localhost postfix/postscreen[661131]: HANGUP after 0
from
[159.100.252.217]:57998 in tests before SMTP
handshake Oct 13 13:21:57 localhost postfix/postscreen[1064274]: HANGUP
after 0 from [159.100.252.217]:49520 in tests before SMTP handshake ...
I did not find anything indicating a compromise. The report only shows
connection closing before the SMTP handshake. (mx.rievo.net
159.100.252.217)
It could be rspamd's MX check triggering these connections based on the
three sources documented in rspamd:
https://docs.rspamd.com/modules/mx_check/#sources-checked
Could these checks be misclassified as brute force,
"The MX Check module verifies that the sending domains in a message
actually have working mail infrastructure. For each candidate domain it
resolves the MX records (falling back to A/AAAA per RFC 5321 ยง5.1 when
no MX exists), classifies the resolved IP addresses, and - for routable,
public addresses - opens a short TCP probe to port 25 to confirm that
something is listening. "
I expect some places would consider them that way...
or should I change my
configuration?
there's at least the "We highly recommend populating exclude_mxs with
the large, shared MX pools that most of your mail legitimately comes
from" if you're not doing it, but the "DNS-only mode (no TCP probing)"
would be safer against this...
good job mx_check is not enabled by default.
According to the documentation:
https://docs.rspamd.com/modules/mx_check/#caching - sane MX should not
experience any issues. The only troublesome case is when there is some
insane tarpitting, so Rspamd cannot distinguish "not working MTA" from
tarpitting timeouts. We can perhaps address this issue as well by
adding some counter to `tc:` records, so Rspamd would consider
multiple timeouts as "broken MTA".
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
