Blacklist for mail domain not working anymore

[esackbauer]

Contribution guidelines

• I've read the contribution guidelines and wholeheartedly agree

Checklist prior issue creation

• I understand that failure to follow below instructions may cause this issue to be closed.
• I understand that vague, incomplete or inaccurate information may cause this issue to be closed.
• I understand that this form is intended solely for reporting software bugs and not for support-related inquiries.
• I understand that all responses are voluntary and community-driven, and do not constitute commercial support.
• I confirm that I have reviewed previous issues to ensure this matter has not already been addressed.
• I confirm that my environment meets all prerequisite requirements as specified in the official documentation.

Description

Since Version 2025-10, blacklist for mail-domains "*@domain.com" are not working anymore.
Postfix and rspamd accept mails without blocking them.

Steps to reproduce:

1. Blacklist whole mail domain according to https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-bl_wl/
2. enter a domain as this *@blockeddomain.com
3. Send mail from "blockeddomain.com" to mailcow mailbox (its not a catchall)
4. Mail gets received into users mailbox, which should not happen.

Logs:

No logs provided.

Which branch are you using?

master (stable)

Which architecture are you using?

x86_64

Operating System:

Debian 12

Server/VM specifications:

6 GB

Is Apparmor, SELinux or similar active?

no

Virtualization technology:

Hyper-V

Docker version:

28.3.1

docker-compose version or docker compose version:

2.13

mailcow version:

2025-10

Reverse proxy:

Sophos Firewall

Logs of git diff:

Logs of iptables -L -vn:

N/A

Logs of ip6tables -L -vn:

N/A

Logs of iptables -L -vn -t nat:

N/A

Logs of ip6tables -L -vn -t nat:

N/A

DNS check:

N/A

[esackbauer]

After investigating, I have found that I have a MTA (Sophos Firewall) in front of mailcow which I whitelistet as "forwarding host" and also in postscreen. Probably that is the reason why the Deny Filter is not working.

But there are several users affected:
https://community.mailcow.email/d/5515-deny-liste-unwirksam

[FreddleSpl0it]

Try to define the MAILCOW_BLACK and MAILCOW_WHITE Symbol in this conf

mailcow-dockerized/data/conf/rspamd/local.d/groups.conf

Line 5 in 586b3a2

}

and restart rspamd with docker compose restart rspamd-mailcow

it should look like this

symbols {
  "MAILCOW_AUTH" {
    description = "mailcow authenticated";
    score = -20.0;
  }
  "MAILCOW_BLACK" {
    description = "mailcow denylist";
    score = 999.0;
  }
  "MAILCOW_WHITE" {
    description = "mailcow allowlist";
    score = -999.0;
  }
  "CTYPE_MIXED_BOGUS" {
    score = 0.0;
  }
  "BAD_REP_POLICIES" {
    score = 2.0;
  }
  "BAD_HEADER" {
    score = 10.0;
  }
  "BULK_HEADER" {
    score = 4.0;
  }
  "ENCRYPTED_CHAT" {
    score = -20.0;
  }
  "SOGO_CONTACT" {
    score = -99.0;
  }
}

[patschi]

@esackbauer Can you test above and report back?

[esackbauer]

@esackbauer Can you test above and report back?

Does not work for me, but again, I am using a spam solution in front of mailcow which I have whitelisted as "forwarding host" and in postscreen.
However forum has tested and it seems to work:
https://community.mailcow.email/d/5515-deny-liste-unwirksam/9

[hachre]

Try to define the MAILCOW_BLACK and MAILCOW_WHITE Symbol in this conf

mailcow-dockerized/data/conf/rspamd/local.d/groups.conf

Line 5 in 586b3a2

}
and restart rspamd with docker compose restart rspamd-mailcow
it should look like this

symbols {
  "MAILCOW_AUTH" {
    description = "mailcow authenticated";
    score = -20.0;
  }
  "MAILCOW_BLACK" {
    description = "mailcow denylist";
    score = 999.0;
  }
  "MAILCOW_WHITE" {
    description = "mailcow allowlist";
    score = -999.0;
  }
  "CTYPE_MIXED_BOGUS" {
    score = 0.0;
  }
  "BAD_REP_POLICIES" {
    score = 2.0;
  }
  "BAD_HEADER" {
    score = 10.0;
  }
  "BULK_HEADER" {
    score = 4.0;
  }
  "ENCRYPTED_CHAT" {
    score = -20.0;
  }
  "SOGO_CONTACT" {
    score = -99.0;
  }
}

I've had the same issue and for me this was the working solution. The MAILCOW_BLACK and MAILCOW_WHITE stuff was simply missing from my config for some reason

[milkmaker]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.