mirror/docker-mailserver.docker-mailserver
1
0
Fork 0
mirror of https://github.com/docker-mailserver/docker-mailserver.git synced 2025-07-09 17:04:53 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

chore(Postfix): disable DNSBLs (#3069)

Browse source
This commit is contained in:
Georg Lauterbach 2023-02-11 00:24:09 +01:00 • committed by GitHub
parent 29d8dcafb0
commit ac1df91181
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 20 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/content/config/environment.md
View file

@ -75,13 +75,7 @@ Enable or disable Rspamd.
!!! warning "Current State"
Rspamd-support is under active development. Be aware that breaking changes can happen at any time.
Currently, rspamd is integrated into Postfix as a milter. However, there is no official DKIM/DMARC support for rspamd in DMS as of now (WIP). To get more information, see [the detailed documentation page for Rspamd][docs-rspamd].
!!! warning "Rspamd and DNS Block Lists"
When you use Rspamd, you might want to use the [RBL module](https://rspamd.com/doc/modules/rbl.html). If you do, make sure your DNS resolver is set up correctly (i.e. it should be a non-public recursive resolver). Otherwise, you [might not be able](https://www.spamhaus.org/faq/section/DNSBL%20Usage#365) to make use of the block lists.
Rspamd-support is under active development. Be aware that breaking changes can happen at any time. To get more information, see [the detailed documentation page for Rspamd][docs-rspamd].
- **0** => disabled
- 1 => enabled
@ -104,10 +98,13 @@ Amavis content filter (used for ClamAV & SpamAssassin)
##### ENABLE_DNSBL
This enables the [zen.spamhaus.org](https://www.spamhaus.org/zen/) DNS block list in postfix
and various [lists](https://github.com/docker-mailserver/docker-mailserver/blob/f7465a50888eef909dbfc01aff4202b9c7d8bc00/target/postfix/main.cf#L58-L66) in postscreen.
This enables DNS block lists in _Postscreen_. If you want to know which lists we are using, have a look at [the default `main.cf` for Postfix we provide](https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/main.cf) and search for `postscreen_dnsbl_sites`.
Note: Emails will be rejected, if they don't pass the block list checks!
!!! danger "A Warning On DNS Block Lists"
Make sure your DNS queries are properly resolved, i.e. you will most likely not want to use a public DNS resolver as these queries do not return meaningful results. We try our best to only evaluate proper return codes - this is not a guarantee that all codes are handled fine though.
**Note that emails will be rejected if they don't pass the block list checks!**
- **0** => DNS block lists are disabled
- 1 => DNS block lists are enabled

8
docs/content/config/security/rspamd.md
View file

@ -23,6 +23,14 @@ You can find a list of all Rspamd modules [on their website][modules].
### DMS' Defaults
!!! danger "Rspamd and DNS Block Lists"
When using Rspamd, the [RBL module](https://rspamd.com/doc/modules/rbl.html) is enabled by default. As a consequence, Rspamd will do a variety of DNS requests. Amongst other things, Rspamd will query DNS block lists (DNSBLs).
There are a variety of issues involved when using DNSBLs. Rspamd will try to mitigate some of them by properly evaluating all return codes. We urge you not to rely on this though.
If you want to use RBLs, **try to use your own DNS resolver** and make sure it is set up correctly, i.e. it should be a non-public & **recursive** resolver. Otherwise, you might not be able ([see this Spamhaus post](https://www.spamhaus.org/faq/section/DNSBL%20Usage#365)) to make use of the block lists.
You can choose to enable ClamAV, and Rspamd will then use it to check for viruses. Just set the environment variable `ENABLE_CLAMAV=1`.
DMS disables certain modules (clickhouse, elastic, greylist, neural, reputation, spamassassin, url_redirector, metric_exporter) by default. We believe these are not required in a standard setup, and needlessly use resources. You can re-activate them by replacing `/etc/rspamd/local.d/<MODULE>.conf` or overriding DMS' default with `/etc/rspamd/override.d/<MODULE>.conf`.