RBL working too well

I see the pharmacy.cvs IP on the SORBS SPAM blacklist using mxtoolbox.com, but the OK State Tax Commission's IP is not listed anywhere. The cbl.abuseat.org RBL is one that you get when you select 'Use recommended RBLs'.  I would uncheck that for the time being and add zen.spamhaus.org to 'Extra RBL Zones'.

To see all of the RBL-rejected addresses, run the following command:

     zgrep 'reason="rbl"' /var/log/smtp/2021/05/*26*|grep -oP 'from=".*?"'|sort -n|uniq -c

That will let you know if any other desired domain is on an RBL.

Cheers - Bob

I see the pharmacy.cvs IP on the SORBS SPAM blacklist using mxtoolbox.com, but the OK State Tax Commission's IP is not listed anywhere. The cbl.abuseat.org RBL is one that you get when you select 'Use recommended RBLs'.  I would uncheck that for the time being and add zen.spamhaus.org to 'Extra RBL Zones'.

To see all of the RBL-rejected addresses, run the following command:

     zgrep 'reason="rbl"' /var/log/smtp/2021/05/*26*|grep -oP 'from=".*?"'|sort -n|uniq -c

That will let you know if any other desired domain is on an RBL.

Cheers - Bob

Bob, I flipped to the zen.spamhous.org site, and the first message blocked was from ADT... bounce.adtpulse.com
MXTOOLBOX.com shows that domain as clean and green on all RBLs. 
I've disabled it again. 
That 'update' seems to be the same 9.705-7 that we're running. I'll take a closer look overnight when the users are quiet.

Thanks.

Also, there were dozens of other domains that were blocked but didn't show to be a problem on MXTOOLBOX.com.

Thank you for that Bob, for so long it gets tiring helping vendors diagnose their crap and you, me, the rest of us don't get paid to fix their stuff or tell them they're broken. haha  First time 3 people get legit stuff blocked, I get in the UTM, disable recommended, and click apply, THEN GO research it. Since 1999 you're right on as far as I can remember.  signed, another old but extremely long term memory dude over here in Tulsa. 

also, I've installed 9.706-9 on several test boxes, home accounts on friends homes and no complaints yet so it looks like this long awaited firmware is happy, no spam filtering issues, even one client with 90 plus employees on it with a 210 and no web filtering issues.  Thank you sir for all you do and helping others.  

Well, I updated to 9.706-9 and zen.spamhaus.org blocked live.com
mxtoolbox.com shows live.com to be OK!

also. long as we both admit we're obsessed or great at spam filtering, invaluement DNSBL list has been super awesome for the last 3 years I've used it, the owner is Rob McEwen, on linkedin also, we discuss this kind of nonsense.  Invaluement has a free trial to show it works,  just register the IPs and you're done, they're rolling out a newer system that will get around the big dns IDIOTS issues. for example, you've probably learned this the hard way also, never ever use 1111 9999 8888 for dns on the sophos.  psychological damage will occur.   hahaThank you sir

when i said inexperienced people, I mean at SPAMHAUS.....

It's time to open a case with Support.  If Up2Dating to 9.706-9 doesn't resolve this, they'll need to be involved.

Cheers - Bob