The reliable way to stop spam on a self-hosted iRedMail server is to use several filters in sequence rather than one aggressive rule: publish correct DNS identity, reject obvious bad clients at SMTP time with postscreen or a Postfix DNSBL, keep Amavisd and SpamAssassin for message-content scoring, use iRedAPD for narrowly scoped exceptions and greylisting, then deliver detected spam to each user’s Junk folder with Dovecot Sieve.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This design blocks cheap, high-volume abuse before it consumes queue and CPU resources while preserving a recovery path for legitimate mail that a classifier misjudges. Apply the layers in the order below, change one control at a time, and use your Postfix, Amavisd and iRedAPD logs to tune decisions.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow iRedMail’s anti-spam path fits together
Each component answers a different question. DNS authentication asks whether your domain and server have a credible identity. Postscreen or a DNSBL asks whether the connecting client is already known to be abusive. Amavisd and SpamAssassin inspect the message itself. iRedAPD applies policy such as allow lists and greylisting. Sieve decides where a message goes after it has been classified.
| Layer | Where it acts | What it does well | Important trade-off |
|---|---|---|---|
| DNS identity | Before and during delivery | Gives receiving servers consistent A, MX, PTR, SPF, DKIM and DMARC signals | Incorrect records can cause rejection or authentication failure even when the message is legitimate |
| Postscreen | SMTP connection/front door | Rejects or delays suspicious clients before normal SMTP processing and queueing | Changes port-25 behavior and requires authenticated submission on port 587 or 465 for users |
| Postfix DNSBL | SMTP recipient restrictions | Simple list-based rejection using entries such as zen.spamhaus.org and b.barracudacentral.org | Provides less protocol defense than postscreen and depends on correct list response-code handling |
| Amavisd plus SpamAssassin | Message and content scanning | Scores headers, body and other message signals in the normal iRedMail path | Consumes CPU and requires platform-specific configuration and log diagnosis |
| iRedAPD | Policy stage | Supports precise sender, domain, IP and CIDR exceptions, plus greylisting | A broad allow rule can bypass filtering for many senders; greylisting can delay first contact |
| Dovecot Sieve | Mailbox delivery | Places detected spam in Junk so users can recover false positives | It does not stop SMTP traffic; it acts after detection |
1. Establish DNS identity before tuning spam filters
Filtering cannot compensate for a mail server that has no consistent identity. Create the records below for every sending domain and verify them from outside the server before changing rejection thresholds.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Record | Status in the iRedMail guidance | Purpose | What to verify |
|---|---|---|---|
| A | Required | Maps the mail host name to the public mail-server IP | The host name resolves to the address actually used by Postfix |
| MX | Required | Directs incoming mail for the domain to the correct mail host | The MX target has an A record and points to the intended server |
| Reverse PTR | Highly recommended | Maps the public IP back to a stable mail host name; many filters inspect it | The hosting provider or ISP has set the PTR and it matches the forward identity |
| SPF | Highly recommended | Lists the servers authorized to send for the domain | Every legitimate outbound sender is included, and unauthorized infrastructure is absent |
| DKIM | Highly recommended | Adds a cryptographic signature generated by Amavisd | The public TXT key is published at the selector named in outgoing signatures |
| DMARC | Highly recommended | Lets receivers evaluate SPF and DKIM alignment and decide what to do when both fail | SPF and DKIM pass and align before you enforce a reject policy |
- Set the mail host’s A record and the domain’s MX record.
- Ask the ISP or hosting provider that controls the public IP to set its reverse PTR.
- Publish SPF for all authorized senders.
- Publish the DKIM TXT record generated by Amavisd.
- Add DMARC only after SPF and DKIM are passing and aligned. Begin with a monitoring policy if you are still discovering legitimate senders, then tighten it after reviewing reports.
Do not move directly to a strict DMARC p=reject policy while SPF or DKIM is incomplete. A misaligned forwarding service, help-desk system or third-party sender can otherwise be rejected as forged mail.
2. Choose the SMTP-time gate
Postscreen for a new deployment
iRedMail’s performance guidance favors postscreen over a pure DNSBL configuration because it combines DNSBL checks with additional SMTP protocol defenses before normal Postfix processing. That early decision prevents many abusive connections from entering the local queue, saving disk, memory and CPU resources.
Enable the postscreen configuration using the procedure for your iRedMail release, then inspect the DNSBL sites it enables rather than assuming every list is appropriate for your traffic. Stage the change while watching Postfix logs and deferred mail. Keep a rollback copy of the original Postfix configuration.
Enabling postscreen changes how users submit mail. Port 25 is handled for mail sent by other mail servers; end users must authenticate and submit through port 587 with TLS or port 465 with SSL. Update desktop clients, phones, applications and monitoring systems before enforcing the migration.
Postfix DNSBL when postscreen is not suitable
A direct DNSBL setup is the simpler fallback. Add reject_rbl_client entries to smtpd_recipient_restrictions after reject_unauth_destination, then reload Postfix. An official iRedMail example uses these providers:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
smtpd_recipient_restrictions =
reject_unauth_destination,
reject_rbl_client zen.spamhaus.org,
reject_rbl_client b.barracudacentral.orgThe exact response-code syntax required by a list matters. Read each provider’s current usage rules and confirm that your resolver returns the expected codes. Do not add the same DNSBL checks through both postscreen and the recipient-restriction path without a deliberate reason: duplicate queries add load and can make troubleshooting harder.
Protect DNSBL lookups with caching
Mail services make large numbers of DNS queries. Run a local caching resolver on a busy server so repeated lookups are answered locally and list providers see fewer queries. Free DNSBL services can return improper responses when query limits are exceeded, which can turn a useful block list into unreliable behavior.
3. Keep Amavisd and SpamAssassin working
In the default iRedMail path, Amavisd calls SpamAssassin. SpamAssassin is normally not a separate daemon that you enable in isolation: its rules are read by the Amavisd scanning process. SMTP-time blocking and content scanning are complementary, so do not disable Amavisd, ClamAV or SpamAssassin merely because postscreen or a DNSBL is catching obvious abuse.
| Platform or purpose | File or setting |
|---|---|
| Debian or Ubuntu Amavisd overrides | /etc/amavis/conf.d/50-user |
| Debian or Ubuntu SpamAssassin rules | /etc/mail/spamassassin/local.cf |
| FreeBSD SpamAssassin rules | /usr/local/etc/mail/spamassassin/local.cf |
| Amavisd diagnostic switch | $sa_debug = 1 in the Amavisd configuration |
Put SpamAssassin rule changes in local.cf; put Amavisd behavior changes in the platform’s Amavisd override file. After editing, restart or reload the relevant service as required by your release and send a controlled test message. The normal evidence of scanning is in the Postfix mail log and in headers such as X-Spam-Status and X-Spam-Flag.
When spam headers are missing
- Confirm that the message actually traverses Amavisd rather than being accepted by a separate transport.
- Check the Postfix log for the Amavisd hand-off and return status.
- Verify the active SpamAssassin configuration file and syntax.
- Temporarily enable
$sa_debug = 1, reproduce the problem, and inspect the resulting log detail. - Disable debugging after diagnosis so production logs do not grow unnecessarily.
A missing header is a diagnostic problem, not a reason to add a second independent SpamAssassin daemon. Fix the hand-off and configuration that iRedMail already uses.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
4. Use iRedAPD for precise exceptions and greylisting
Allow and block only the smallest necessary target
Enable the iRedAPD amavisd_wblist plugin and manage entries with wblist_admin.py. The list system can target a complete address, a domain, a domain and its subdomains, an IP address or a CIDR network.
| Target form | Scope | Risk to consider |
|---|---|---|
[email protected] |
One sender address | Lowest blast radius; suitable for a recurring false positive from one address |
@example.net |
Addresses in one domain | Every sender in that domain receives the exception |
@.example.net |
The domain and its subdomains | Can bypass filtering for a large organization and all of its subdomains |
| An IP address | One sending host | May be shared by many unrelated senders if the provider uses common infrastructure |
| A CIDR network | An address range | Broadest scope; use only when you control or fully trust the entire range |
Start with a single address. Expand to a domain, subdomain pattern or network only when logs prove that the narrower exception is insufficient. Review broad allow rules periodically; an address that was trustworthy can later be compromised.
Greylisting without surprising legitimate senders
Greylisting temporarily refuses a new sender-recipient-IP triplet and waits for a standards-compliant retry. iRedAPD 1.7.0 and later document these defaults:
| Default | Value | Meaning |
|---|---|---|
| Retry block | 15 minutes | A retry arriving sooner than this is rejected |
| Successful-triplet retention | 30 days | A client that has completed greylisting is remembered for this period |
| Unsuccessful-triplet retention | 2 days | A client that never retries is retained for this period |
Use training mode on a new server so you can observe behavior before enforcing delays. Some companies redeliver immediately from a different server or do not retry in the way greylisting expects. Whitelist those senders narrowly instead of disabling every other filter. Watch delivery-time complaints and the iRedAPD logs while you tune the policy.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →5. Send detected spam to Junk instead of silently losing it
Rejection is appropriate for clear SMTP abuse, but a content score is not infallible. A global Dovecot Sieve rule gives users a review path by filing messages marked as spam into Junk.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Use the global Sieve sample supplied for your iRedMail release. It normally checks the spam header added by Amavisd, for example:
require ["fileinto"];
if header :is "X-Spam-Flag" "YES" {
fileinto :create "Junk";
stop;
}If your deployment uses a different header or value, inspect a real classified message and adjust the condition to match it. Do not assume that a rule written for one iRedMail release matches a customized Amavisd header set.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Save the global Sieve file in the location used by your Dovecot configuration.
- Set Dovecot’s
sieve_beforesetting to that file so it runs before per-user rules. - Set ownership to
vmail:vmail. - Set permissions to
0500. - Restart Dovecot.
- Send a controlled test that receives the spam marker and verify that it appears in the user’s Junk folder.
Sieve acts after Amavisd has classified the message; it is not a substitute for postscreen, DNSBL checks or content scanning. Its value is recoverability: users can inspect false positives and move legitimate mail back to the inbox.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Roll out the layers in a controlled order
Make one change at a time and keep a timestamped record of the active configuration. The following sequence minimizes the chance that a DNS, transport and policy change will hide the real cause of a delivery failure.
- Baseline DNS. Verify A and MX first, then PTR, SPF and DKIM. Add DMARC in monitoring mode and inspect alignment.
- Baseline scanning. Confirm that a normal message passes through Amavisd and receives expected
X-Spam-*headers. - Add the SMTP gate. Prefer postscreen for a new deployment, or add the documented DNSBL restrictions if postscreen is unsuitable. Monitor rejects and deferrals.
- Migrate submission. Test authenticated port 587/TLS and 465/SSL from every application before treating port 25 as server-to-server only.
- Add policy exceptions. Record the exact false positive, create the narrowest iRedAPD entry that fixes it, and review the result.
- Enable greylisting. Observe training mode first, then enforce it after you know which legitimate senders need exceptions.
- Enable Junk delivery. Confirm the global Sieve rule with both a spam-marked test and a normal message.
Test cases worth keeping
| Test | Expected result | If it fails |
|---|---|---|
| Authenticated user submits through 587 with TLS | Message is accepted and relayed according to policy | Check submission service, credentials, TLS certificate and client port |
| Authenticated user submits through 465 with SSL | Message is accepted over implicit TLS | Check the SSL listener and client encryption mode |
| Remote server connects to port 25 | Postscreen or Postfix applies the SMTP-time checks | Inspect listener bindings and postscreen logs |
| Known spam test receives a spam marker | Amavisd and SpamAssassin add the expected headers | Check the Amavisd hand-off and SpamAssassin configuration |
| Marked spam reaches a user mailbox | Dovecot files it into Junk | Check the active sieve_before path, ownership, permissions and header match |
| A legitimate sender is delayed or scored as spam | The event is visible in logs and can be corrected narrowly | Use a specific iRedAPD allow entry or adjust the relevant policy after evidence |
Common failure modes and safe fixes
Users can no longer send after postscreen is enabled
That is usually a submission-port migration problem. Configure clients and applications for authenticated 587/TLS or 465/SSL; do not try to make end-user submission depend on port 25, which postscreen reserves for mail-server traffic.
DNSBL results are inconsistent
Check for missing local DNS caching, provider query limits and incorrect response-code handling. Confirm that you have not duplicated the same list in postscreen and smtpd_recipient_restrictions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Legitimate mail is rejected before SpamAssassin sees it
SMTP-time controls intentionally act before content scanning. Inspect the Postfix or postscreen log, identify the exact rule that rejected the connection, and create a narrowly scoped exception only when the sender is verified.
Greylisting delays a critical partner
Use training mode data to identify the partner’s address or network and whitelist the smallest reliable target. Do not turn off all greylisting because one sender uses non-standard retry behavior.
False positives disappear instead of reaching users
Check whether the message is being rejected at SMTP time or accepted and later filed. If the classifier accepts it but users cannot find it, verify the global Sieve file, the sieve_before setting, ownership, permissions and the actual spam header.
DMARC rejects your own forwarded or third-party mail
Review SPF and DKIM alignment and identify every legitimate sending service before enforcing p=reject. A DMARC policy cannot repair an incomplete SPF or DKIM deployment.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesOpen-source configuration versus Enterprise management
The open-source iRedMail path exposes these controls through Postfix, Amavisd, SpamAssassin, iRedAPD and Dovecot configuration. iRedMail Enterprise Edition v1.8.4, published September 10, 2026, adds web-managed greylisting, lists, spam policy and quarantine, including per-domain and per-user anti-spam settings. The underlying design remains layered; the difference is whether policy is edited in configuration files and administration scripts or through the enterprise management interface.
Ongoing maintenance checklist
- Review Postfix and postscreen rejects for unexpected legitimate senders.
- Check DNSBL query health and local resolver caching.
- Review Amavisd and SpamAssassin logs when spam headers disappear or scores change unexpectedly.
- Audit iRedAPD allow and block entries for broad domains, subdomains and CIDR ranges.
- Review greylisting delays and add only evidence-based exceptions.
- Sample the Junk folders for false positives and confirm that users can recover messages.
- Keep SPF, DKIM and DMARC records synchronized with every new outbound service.
- Retest authenticated submission after Postfix or certificate changes.
Official iRedMail material does not publish a universal spam-reduction percentage or false-positive benchmark for this stack. Judge the deployment with your own logs, queue size, delivery complaints and recovered false positives rather than promising a fixed improvement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
