Skip to content

Spam protection


DNSBL lists can be used to avoid or reduce spam mails. In these lists, server/IPs are collected that have been reported for spam, for example.

A good collection of DNSBL lists is the one used by Mailcow.

For integration with Postfix, the following part must be included in the Postfix file

postscreen_dnsbl_action = enforce
postscreen_dnsbl_sites =[18;19;20]*-2*-2[0..255].0*-2[0..255].1*-4[0..255].2*-6[0..255].3*-8*2*2*2*3*2*1*2*2*2*7*5[10;11;12]*4*8*6*3*2*2*2[10;11]*8[4..7]*6*4*3
postscreen_dnsbl_threshold = 6
postscreen_dnsbl_ttl = 5m

Additionally, a Recursive DNS Revolve should be installed on the mail server. Some Recursive Resolvers are unbound or Powerdns Recrusor.


To avoid that mails from your own server are recognized as spam, some countermeasures can be taken.

Some simple options are RDNS, SPF, DKIM and DMARC.

To check the mail server configuration I can recommend the test from First of all, make sure that the mail server IP is not on any DNSBL list. A site to check some lists is or

RDNS (Reverse DNS)

Reverse DNS (PTR record) is the resolution of the IP of the sender into a hostname. This hostname must correspond to the FQDN of the own mail server.

As an example, my mail server has the FQDN, the IPv4 is and the IPv6 is 2001:780:250::dead, the PTR record must look like this. 86400 IN PTR 3600 IN PTR


The SPF records in the DNS determine which mail servers are allowed to send mail for the domain. The SPF record is stored as a simple TXT record in the DNS. For example, to authorize only the mail servers entered via the MX record to send, the following entry would be sufficient. 86400 IN TXT "v=spf1 mx -all"
A simple generator can be found here.


DKIM is a method by which it can be checked whether a mail comes from a specific mail server. A public key is stored in the DNS in the zone of the sender. When the mail is sent, the mail server adds a signature calculated with the private key to the mail, which can be validated with the key in the DNS.


DMARC is a rule that is stored as a TXT record in the DNS of the sender and determines what should be done in the event of a violation of SPF or DKIM. This can be used to determine what should happen to a mail if the SPF or DKIM check has failed, indicating that the sender server is not authorized for the domain.