Outgoing mail blocked by spamhaus

Question

I am using zen.spamhaus for spam protection and it seems to work great. One problem though... it also check outgoing messages. This is good in that it prevent unauthorized mail from going out, but it is also blocking some of my users, even though they authenticate first (as is required). Is there a way to change this so that authenticated users will not be picked up by spamhaus?

Answer 1

If you look at/implement my tutorial Frontline spam defense for Mac OS X Server you will see the correct configuration for checking authentication before the RBLs. In addition you will reduce your spam intake significantly.
If you don't want to add anything to your default configuration, make sure that the following parameters in /etc/postfix/main.cf are in the right horizontal order:
smtpdclientrestrictions = permit_mynetworks, permitsaslauthenticated, rejectrblclient zen.spamhaus.org, permit
smtpdrecipientrestrictions = permit_mynetworks, permitsaslauthenticated, rejectunauthdestination, rejectrblclient zen.spamhaus.org, permit
This will make sure that once authenticated or coming from the internal network, the RBL won't be queried.
Furthermore, I would add a separate submission port (587) for your authenticated users only, bypassing the content filter as well. This can be done by adding the following to /etc/postfix/master.cf
submission inet n - n - - smtpd
-o content_filter=
-o smtpdrecipient_restrictions=permit_saslauthenticated,reject
(3 spaces before -o )