Clear a blacklist / RBL problem on your SMTP server

If your SMTP server has been blacklisted, the first step is to find out which RBLs (Real-time Blackhole Lists) are listing your IP address. Here are some great tools:

• multirbl.valli.org
• mxtoolbox.com/blacklists.aspx

A useful tutorial on the subject: CentOS Postfix spam tips and quick solution.

How to troubleshoot spamming activity on a Postfix mail server

The blacklisting is usually caused by a compromised account or script sending spam through your server. These commands help you find and clean it up.

1. See the mail queue:

   mailq

2. Flush the mail queue:

   postfix flush
   # or
   postfix -f

3. Remove all mails from the queue:

   postsuper -d ALL

4. Remove all mails in the deferred queue:

   postsuper -d ALL deferred

5. Delete all queued messages from or to the domain spamdomain.com:

   ./postfix-delete.pl spamdomain.com

6. Delete all queued messages that contain the word «abc» in the e-mail address:

   ./postfix-delete.pl abc

7. Count the messages sitting in the deferred queue:

   find /var/spool/postfix/deferred -type f | wc -l

8. Get a sorted list of the accounts that have the most mail in the queue. The two or three at the end of the list are usually the spammers:

   mailq | grep ^[A-F0-9] | cut -c 42-80 | sort | uniq -c | sort -n | tail

Once the source of the spam is stopped and the queue is clean, request delisting from each RBL that still lists your IP.