I run a Postfix/PostfixAdmin server at my-domain.info and forward some mailbox messages to Gmail using SRS. I already use several DNS-based blocklists in smtpd_relay_restrictions, including Spamhaus ZEN, DBL, SpamCop, Mailspike, and others. However, some spam passes those checks and is only rejected later when Gmail receives the forwarded message. Gmail reports that the sending IP has very low reputation and blocks the message.
For example, mail originally sent to [email protected] is forwarded to [email protected], but the forwarded message is identified as spam only by Gmail. I understand that SpamAssassin or another content filter could help, but this is a low-memory server and I am concerned about resource usage and false positives. Are there reliable domain- or content-based blocklists I could use instead, or another lightweight way to improve filtering before messages are forwarded?
4 Answers
Rspamd is worth considering instead of relying only on blocklists. It is generally lighter and more flexible than a traditional SpamAssassin setup, and it can inspect message content, URLs, authentication results, and reputation data. No filter will be perfect, so configure it to score or tag uncertain messages rather than immediately reject everything above a low threshold.
The Gmail response points to a forwarding and reputation problem more than a missing blocklist. With SRS, your server becomes the apparent sender for forwarded spam, so Gmail judges your server's IP reputation. Google generally recommends preventing spam from being forwarded, or using a separate IP or domain for forwarding.
Also verify that your DNS-based lists are actually working. Spamhaus queries can fail or be refused when made through public resolvers such as 8.8.8.8 or 1.1.1.1. Test the lookups from the mail server and use a local recursive resolver such as Unbound if necessary. The old relays.visi.com list appears to be unavailable, and querying Spamhaus SBL separately is unnecessary because ZEN already includes it.
You already have a domain-based list: Spamhaus DBL. However, rhsbl checks generally cover the envelope sender and HELO name. Spam can use a clean disposable sender domain while hiding malicious domains or URLs in the message body, which requires content inspection rather than SMTP-time DNS checks. A tool such as Rspamd can combine reputation, headers, URLs, and heuristics more effectively than adding more static lists.
Forwarding mail directly to Gmail can be fragile even when SRS is configured correctly. SPF, DKIM, and DMARC alignment still matter, and Gmail may reject messages because of forwarding-server reputation rather than because authentication failed. Another option is to keep the mail on your server and have Gmail retrieve it through an external-mail mechanism, or synchronize it over IMAP and deliver it separately, so your server is not relaying every spam message to Gmail.
There is no static blacklist that will reliably catch all spam. Spammers constantly change IP addresses and domains, and aggressive use of many lists can cause legitimate mail to be rejected. Effective filtering normally combines DNS reputation with SPF, DKIM, DMARC, message content checks, URL reputation, and sometimes statistical learning.
For automatic forwarding, SRS alone is not the whole solution. Make sure SPF, DKIM, and DMARC are handled correctly, but remember that authentication does not replace spam filtering. If forwarding remains unreliable, local storage plus IMAP synchronization avoids making your SMTP server the sender of record for unwanted mail.