PowerMTA Blacklist Detection and IP Delisting Workflow

Detecting Blacklisting via Accounting Logs

Blacklist-specific rejection messages appear in the dsnDiag field of the PowerMTA accounting log format. These messages typically contain keywords like "blacklisted", "DNSBL", "blocked", "listed", or reference specific blacklist provider names.

# Real-time blacklist detection from accounting log
grep -iE "spamhaus|sorbs|barracuda|blacklist|dnsbl|listed|blocked" /var/log/pmta/accounting.csv | \
  awk -F, '$1 ~ /[bt]/' | awk -F, '{print substr($10,1,80)}' | \
  sort | uniq -c | sort -rn | head -15

# Automated detection script (run every 15 minutes via cron):
BLACKLIST_COUNT=$(grep -ic "blacklist\|DNSBL\|spamhaus" /var/log/pmta/accounting.csv 2>/dev/null)
if [ "$BLACKLIST_COUNT" -gt "10" ]; then
    echo "ALERT: Possible blacklisting detected — $BLACKLIST_COUNT events" | \
    mail -s "PowerMTA Blacklist Alert" ops@yourdomain.com
fi

Manual Blacklist Verification

When accounting logs suggest blacklisting, verify each sending IP against the major blacklists directly. The Spamhaus ZEN lookup covers SBL, XBL, and PBL in one query.

# DNS blacklist verification for each sending IP
check_ip() {{
    local IP=$1
    local REV=$(echo $IP | awk -F. '{{print $4"."$3"."$2"."$1}}')
    echo "=== Checking $IP ==="
    
    # Spamhaus ZEN
    RESULT=$(dig +short $REV.zen.spamhaus.org 2>/dev/null)
    [ -n "$RESULT" ] && echo "  LISTED on Spamhaus ZEN: $RESULT"
    
    # CSS (Spamhaus CSS)
    RESULT=$(dig +short $REV.css.spamhaus.org 2>/dev/null)
    [ -n "$RESULT" ] && echo "  LISTED on Spamhaus CSS: $RESULT"
    
    # Barracuda
    RESULT=$(dig +short $REV.b.barracudacentral.org 2>/dev/null)
    [ -n "$RESULT" ] && echo "  LISTED on Barracuda: $RESULT"
    
    # SORBS
    RESULT=$(dig +short $REV.dnsbl.sorbs.net 2>/dev/null)
    [ -n "$RESULT" ] && echo "  LISTED on SORBS: $RESULT"
}}

for IP in 185.x.x.10 185.x.x.11 185.x.x.12; do check_ip $IP; done

# Online tools for comprehensive check:
# https://mxtoolbox.com/blacklists.aspx
# https://multirbl.valli.org
# https://check.spamhaus.org

Delisting Procedures by Blacklist

Immediate Operational Response

# Immediate steps when blacklisting is confirmed:

# Step 1: Quarantine the affected IP(s)
# Remove from active virtual-mta-pool immediately
# Edit /etc/pmta/config to remove affected IP from pool
pmta reload

# Step 2: Route affected traffic to clean IPs
# If you have reserve IPs, add them to the pool temporarily

    # virtual-mta gmail-ip-1     # Removed — blacklisted
    virtual-mta gmail-ip-2       # Clean IPs continue
    virtual-mta gmail-ip-3
    virtual-mta reserve-ip-1     # Add reserve IP


# Step 3: Submit delisting requests for all blacklists
# Do multiple blacklists in parallel — each takes time

# Step 4: Investigate root cause before re-adding the IP
# Why was this IP blacklisted?
# - Compromised account sending spam?
# - List quality issue producing trap hits?
# - High complaint rate from specific campaign?

Post-Delisting Recovery

Delisting removes the IP from the blacklist database, but receiving MTA caches may still reject connections for 24-48 hours after delisting (DNS TTL). Additionally, the sending reputation at ISPs like Gmail and Microsoft is not reset by delisting — the negative activity that caused the listing still affects their internal reputation scores.

# After delisting: gradual re-introduction of the IP
# Do NOT immediately return to full production volume

# Week 1 post-delisting: low volume, engaged subscribers only

    virtual-mta-pool recovery-pool   # Single clean IP + recovering IP at 20% weight
    max-smtp-out tuning 3                   # Conservative
    max-msg-rate 100/h


# Week 2-3: increase if monitoring shows no new issues
# Monitor Microsoft SNDS and Google Postmaster Tools integration daily during recovery
# Any new listing = investigate root cause more deeply

Frequently Asked Questions