How to fix 550 5.7.1 Service unavailable; client [xxx.xxx.xxx.xxx] blocked using zen.spamhaus.org (in reply to RCPT TO command)?

[stormbinary]

Please can someone help?! Any mail sent to my mail server is returned.

This config has worked for more than 4 years and then suddenly stopped. I did recreate the containers with no effect.

Here is part of my compose file:

services:
  mail:
    image: tvial/docker-mailserver:latest
    hostname: ${HOSTNAME}
    domainname: ${DOMAINNAME}
    container_name: ${CONTAINER_NAME}
    ports:
    - "25:25"
    - "465:465"
    - "143:143"
    - "587:587"
    - "993:993"
    - "4190:4190"
    volumes:
    - ./data/mail/data:/var/mail
    - ./data/mail/state:/var/mail-state
    - ./mail/config/:/tmp/docker-mailserver/
      #- ./data/entry/acme/acme-v01.api.letsencrypt.org/sites/xxxxxxxxx:/tmp/ssl:ro
    - ./data/entry/acme/acme-v02.api.letsencrypt.org/sites/xxxxxxxx/xxxxxxx.crt:/tmp/ssl/cert/public.crt:ro
    - ./data/entry/acme/acme-v02.api.letsencrypt.org/sites/xxxxxxxx/xxxxxxxxxx.key:/tmp/ssl/private/private.key:ro
    
    environment:
    - DMS_DEBUG=${DMS_DEBUG}
    - ENABLE_CLAMAV=${ENABLE_CLAMAV}
    - ONE_DIR=${ONE_DIR}
    - ENABLE_POP3=${ENABLE_POP3}
    - ENABLE_FAIL2BAN=${ENABLE_FAIL2BAN}
    - ENABLE_MANAGESIEVE=${ENABLE_MANAGESIEVE}
    - OVERRIDE_HOSTNAME=${OVERRIDE_HOSTNAME}
    - POSTMASTER_ADDRESS=${POSTMASTER_ADDRESS}
    - POSTSCREEN_ACTION=${POSTSCREEN_ACTION}
    - REPORT_RECIPIENT=${REPORT_RECIPIENT}
    - REPORT_SENDER=${REPORT_SENDER}
    - REPORT_INTERVAL=${REPORT_INTERVAL}
    - SMTP_ONLY=${SMTP_ONLY}
    - SSL_TYPE=${SSL_TYPE}
    - TLS_LEVEL=${TLS_LEVEL}
    - SPOOF_PROTECTION=${SPOOF_PROTECTION}
    - ENABLE_SRS=${ENABLE_SRS}
    - PERMIT_DOCKER=${PERMIT_DOCKER}
    - VIRUSMAILS_DELETE_DELAY=${VIRUSMAILS_DELETE_DELAY}
    - ENABLE_POSTFIX_VIRTUAL_TRANSPORT=${ENABLE_POSTFIX_VIRTUAL_TRANSPORT}
    - POSTFIX_DAGENT=${POSTFIX_DAGENT}
    - ENABLE_SPAMASSASSIN=${ENABLE_SPAMASSASSIN}
    - SA_TAG=${SA_TAG}
    - SA_TAG2=${SA_TAG2}
    - SA_KILL=${SA_KILL}
    - SA_SPAM_SUBJECT=${SA_SPAM_SUBJECT}
    - ENABLE_FETCHMAIL=${ENABLE_FETCHMAIL}
    - FETCHMAIL_POLL=${FETCHMAIL_POLL}
    - ENABLE_LDAP=${ENABLE_LDAP}
    - LDAP_START_TLS=${LDAP_START_TLS}
    - LDAP_SERVER_HOST=${LDAP_SERVER_HOST}
    - LDAP_SEARCH_BASE=${LDAP_SEARCH_BASE}
    - LDAP_BIND_DN=${LDAP_BIND_DN}
    - LDAP_BIND_PW=${LDAP_BIND_PW}
    - LDAP_QUERY_FILTER_USER=${LDAP_QUERY_FILTER_USER}
    - LDAP_QUERY_FILTER_GROUP=${LDAP_QUERY_FILTER_GROUP}
    - LDAP_QUERY_FILTER_ALIAS=${LDAP_QUERY_FILTER_ALIAS}
    - DOVECOT_TLS=${DOVECOT_TLS}
    - DOVECOT_USER_FILTER=${DOVECOT_USER_FILTER}
    - DOVECOT_PASS_FILTER=${DOVECOT_PASS_FILTER}
    - ENABLE_POSTGREY=${ENABLE_POSTGREY}
    - POSTGREY_DELAY=${POSTGREY_DELAY}
    - POSTGREY_MAX_AGE=${POSTGREY_MAX_AGE}
    - POSTGREY_TEXT=${POSTGREY_TEXT}
    - ENABLE_SASLAUTHD=${ENABLE_SASLAUTHD}
    - SASLAUTHD_MECHANISMS=${SASLAUTHD_MECHANISMS}
    - SASLAUTHD_MECH_OPTIONS=${SASLAUTHD_MECH_OPTIONS}
    - SASLAUTHD_LDAP_SERVER=${SASLAUTHD_LDAP_SERVER}
    - SASLAUTHD_LDAP_SSL=${SASLAUTHD_LDAP_SSL}
    - SASLAUTHD_LDAP_BIND_DN=${SASLAUTHD_LDAP_BIND_DN}
    - SASLAUTHD_LDAP_PASSWORD=${SASLAUTHD_LDAP_PASSWORD}
    - SASLAUTHD_LDAP_SEARCH_BASE=${SASLAUTHD_LDAP_SEARCH_BASE}
    - SASLAUTHD_LDAP_FILTER=${SASLAUTHD_LDAP_FILTER}
    - SASLAUTHD_LDAP_START_TLS=${SASLAUTHD_LDAP_START_TLS}
    - SASLAUTHD_LDAP_TLS_CHECK_PEER=${SASLAUTHD_LDAP_TLS_CHECK_PEER}
    - SASL_PASSWD=${SASL_PASSWD}
    - SRS_EXCLUDE_DOMAINS=${SRS_EXCLUDE_DOMAINS}
    - SRS_SECRET=${SRS_SECRET}
    - RELAY_HOST=${RELAY_HOST}
    - RELAY_PORT=${RELAY_PORT}
    - RELAY_USER=${RELAY_USER}
    - RELAY_PASSWORD=${RELAY_PASSWORD}
    # dn insert
    - ONE_DIR=1
    - ENABLE_MANAGESIEVE=1
    - SSL_CERT_PATH=/tmp/ssl/xxxxxxxxxx.crt
    - SSL_KEY_PATH=/tmp/ssl/xxxxxxxxxxx.key

Thanks.

[glime-ai[bot]]

Please note that this response was created using generative AI, leveraging previously available information from the repository. This information may be helpful. However, it is our strong recommendation that you carefully consider the information before blindly applying it.

---

To address the issue of emails being returned when sent to your mail server, there are several areas to check based on the provided docker-compose configuration and the common issues documented in the Docker Mailserver project. Here are some steps and checks you can perform:

1. DNS and MX Records: Ensure that your domain's DNS settings are correctly configured. The MX record should point to the hostname you've specified (${HOSTNAME}) and that hostname should resolve to the IP address of your server. Incorrect DNS or MX record settings are a common cause of mail delivery issues.

2. Firewall and Port Forwarding: Verify that your server's firewall (if any) allows inbound connections on the mail-related ports (25, 465, 587, 993, 143, 4190). Additionally, if your server is behind a router or NAT, ensure that these ports are forwarded correctly to your server.

3. SSL/TLS Configuration: You've specified custom paths for your SSL certificate (SSL_CERT_PATH) and key (SSL_KEY_PATH). Ensure that these files are correctly mounted into the container and that they are valid (not expired, and the certificate matches the domain name). You can test your SSL configuration by connecting to your server using OpenSSL (as shown in your context with openssl s_client -connect 0.0.0.0:25 -starttls smtp -CApath /etc/ssl/certs/). Replace 0.0.0.0 with your server's IP address or domain name.

4. Check Container Logs: Inspect the logs of your Docker Mailserver container for any errors or warnings that could indicate what's going wrong. You can view the logs by running docker logs ${CONTAINER_NAME}. Look for any messages related to failed email deliveries or SSL/TLS issues.

5. Environment Variables: You've listed a large number of environment variables in your configuration. Double-check that these are all set correctly, especially those related to authentication and encryption (SSL_TYPE, TLS_LEVEL, DOVECOT_TLS, etc.). Incorrect settings here could lead to issues with mail delivery or client connections.

6. SPF, DKIM, and DMARC: Ensure that you have SPF, DKIM, and DMARC records set up for your domain. These are email authentication methods that help prevent your emails from being marked as spam or rejected by receiving servers. The Docker Mailserver project provides documentation on setting these up.

7. Relay Configuration: If you're using an email relay (RELAY_HOST), ensure that the relay server's settings are correctly configured and that the relay server is not rejecting your emails. This includes verifying the RELAY_PORT, RELAY_USER, and RELAY_PASSWORD.

If after checking these areas the problem persists, consider providing more specific error messages or logs that could help in diagnosing the issue further.

This comment was generated by Glime.

[casperklein]

You are using an very old image: tvial/docker-mailserver:latest. For security reasons (and more features) you should update to the latest version mailserver/docker-mailserver:13.3.1. Make sure to read the changelog.

---

You can disable the (spamhaus) blacklists via ENABLE_DNSBL=0