Incoming mail to a Plesk server gets rejected: Client host blocked using zen.dnsbl

Symptoms

• Incoming emails to Plesk server (with configured local mail service) from specific senders are rejected, blocked or received into junk folder.

• The following message appears in the mail client:

  An error occurred sending mail: Unable to establish a secure link with SMTP server mail.example.com using STARTTLS since it doesn't advertise that feature. Switch off STARTTLS for that server or contact your service provider.

• The following logs may be present in the /var/log/mailllog file:

  localhost postfix/smtpd[17588]: NOQUEUE: reject: RCPT from mail.server: 554 5.7.1 Service unavailable; Client host [203.0.113.2] blocked using zen.dnsbl; http://www.spamhaus.org/query/bl?ip=203.0.113.2; [email protected] [email protected] proto=ESMTP helo=<mail.server>
  localhost /usr/lib64/plesk-9.0/psa-pc-remote[21418]: Message aborted.

  554 5.7.1 Service unavailable; Client host [203.0.113.2] blocked using dnsrbl.org;DNSRBL Active Listing -- For More Details Visit: https://dnsrbl.org/lookup.cgi?ip=203.0.113.2; [email protected] [email protected] proto=ESMTP

  OR

  The following log can be found in the %plesk_dir%Mail ServersMail EnableLoggingSMTPSMTP-Debug-XXXXXX.log file:

  E-E0113: [1964] Message marked as spam: (203.0.113.2) was found in DNS blacklisted database 0spam.fusionzero.com.

Cause

The IP address of sending server is listed in spam blacklists.

Resolution

If it is required to receive emails from the blacklisted IP perform one of the following resolutions:

• Add the IP address of the sender to the whitelist:

  How to white-list an IP address in Plesk to accept all emails from it?

• Remove the blacklist which blocks emails from the list check or disable DNS blackhole lists at all:

  1. Log into Plesk.

  2. Go to Plesk > Tools & Settings > Mail Server Settings and scroll down till the Switch on spam protection based on DNS blackhole lists directive.

  3. Remove the specific DNS blacklist from the DNS zones for DNSBL service field, e.g.:

     [BEFORE]

     zen.dnsbl;0spam.example.com

     [AFTER]

     zen.dnsbl

     OR

     Completely disable DNS blackhole lists by unmarking the Switch on spam protection based on DNS blackhole lists checkbox.

  4. Press the OK button to apply changes.

Note: for Windows, if DNS blackhole lists is already disabled, enable it and disable back. Probably, it was manually enabled in Mail Enable SMTP Connector Settings.

Additional information

The spam blacklist tool may also be defined in /etc/postfix/main.cf, for example:

reject_rbl_client new.spam.dnsbl.sorbs.net