Fix CWP Spamhaus Email Blocking Caused by Open Resolver Error

CWP Spamhaus email blocking occurs when Spamhaus returns an open resolver error instead of a block list result, causing Postfix to reject all incoming mail. Control Web Panel (CWP) configures Postfix to query zen.spamhaus.org without authentication by default, and Spamhaus no longer supports unauthenticated DNS-based Block List (DNSBL) queries. Three solutions restore incoming mail: disable Spamhaus in CWP Admin, remove the rule directly from Postfix, or upgrade to the authenticated Spamhaus Data Query Service (DQS).

Prerequisites

• Root access to the server. If you do not yet have root, see How to Obtain Root Access to Your Server.
• Secure Shell (SSH) access for Solutions 2 and 3. See How to Connect to Your Server with SSH if you need help.

How to Confirm CWP Spamhaus Email Blocking

Before applying a fix, confirm the open resolver error is the cause. Check /var/log/maillog or run journalctl -u postfix and look for a rejection line like this:

postfix/smtpd[30551]: NOQUEUE: reject: RCPT from mail.example.com[192.0.2.1]: 554 5.7.1 Service unavailable; Client host [192.0.2.1] blocked using zen.spamhaus.org; Error: open resolver;

The hostname, IP address, and process ID will differ in your log. The values that confirm the issue are zen.spamhaus.org and Error: open resolver.

Spamhaus previously allowed any mail server to query its block list over public DNS at no cost. That open resolver service is no longer available. CWP servers rebuilt with the AntiSpam/AntiVirus option enabled get a Postfix configuration that still queries zen.spamhaus.org without authentication. Spamhaus returns an error instead of a valid result, and Postfix treats that error as grounds to reject every incoming connection.

If that log line matches what you see, one of the three solutions below will stop the rejections. Choose based on how much Spamhaus coverage you need going forward.

Solution 1: Disable Spamhaus Through CWP Admin

This is the fastest fix. CWP Admin provides a one-click action under Email > AntiSpam that removes the Spamhaus integration and automatically updates the Postfix configuration. Use this solution when you do not need Spamhaus as your primary spam filter. Removing Spamhaus leaves no DNSBL checks active on this server; if you rely on block-list filtering to reduce spam volume, consider Solution 3 instead.

1. Log in to Control Web Panel Admin.
2. In the left navigation, expand the Email menu. Click AntiSpam.
   
3. Confirm that Spamhaus shows as currently installed on your server.
   
4. Click the Uninstall Spamhaus to remove the Spamhaus integration. CWP will update the Postfix configuration and reload the service.

Incoming mail should begin flowing within a minute. If it does not, verify Postfix reloaded by running systemctl status postfix. If the service did not reload automatically, run systemctl reload postfix and check /var/log/maillog to confirm the open resolver error no longer appears.

Postfix retries deferred messages on its normal schedule, typically every 5 minutes for recent deferrals, so queued mail will deliver without any extra action.

Solution 2: Remove the Spamhaus Rule from Postfix

Use this solution when you want other filters, such as SpamAssassin, to remain active but only remove the Spamhaus DNSBL check from Postfix. You will edit /etc/postfix/main.cf directly over SSH.

1. Connect to your server over SSH as root.
2. Open the Postfix main configuration file: nano /etc/postfix/main.cf
3. Locate the line that begins with smtpd_recipient_restrictions.
4. Delete the segment , reject_rbl_client zen.spamhaus.org from that line. Remove only that segment, leaving the rest of the restrictions intact.
5. Save and close the file. In nano, press Ctrl+X, then Y, then Enter.

Reload Postfix to apply the change. Using reload instead of restart preserves active SMTP connections:

systemctl reload postfix

New incoming mail will no longer be checked against the Spamhaus DNSBL. Deferred messages will retry on the normal schedule, typically every 5 minutes for recent deferrals.

Important: If you rebuild the mail server in CWP Admin with AntiSpam/AntiVirus enabled, CWP will rewrite main.cf and add the Spamhaus entry back. You will need to repeat these steps after any such rebuild. This is a known limitation of the current CWP AntiSpam module.

Solution 3: Upgrade to Spamhaus DQS (Out of Scope)

The Spamhaus Data Query Service (DQS) is the authenticated replacement for the old open resolver. It works by embedding a personal key into the DNSBL query hostname, satisfying Spamhaus’s current requirements while maintaining full DNSBL coverage.

Important: Configuring Spamhaus DQS requires custom Postfix changes beyond the scope of InMotion Hosting Technical Support. We recommend working with a qualified third-party developer or system administrator to implement this solution.

To implement DQS, follow the official Spamhaus guide for Postfix: Configuring DQS on Postfix. That page covers registering for a DQS key and updating the Postfix DNSBL query strings to use your personalized endpoint.

Important: If the mail server is rebuilt in CWP Admin after you implement DQS, CWP will overwrite the Postfix configuration, and the DQS settings will be lost. Document your DQS query strings before any rebuild so you can restore them quickly.

Conclusion

CWP Spamhaus email blocking from the open resolver error has three fixes: remove Spamhaus through CWP Admin (Solution 1), edit main.cf directly over SSH (Solution 2), or upgrade to the authenticated DQS endpoint (Solution 3). Solutions 1 and 2 restore mail flow in under five minutes. Solution 3 keeps Spamhaus coverage fully active but requires a qualified developer and must be reconfigured after any CWP mail server rebuild. For help with other email issues on your server, visit the InMotion Hosting Email Support Center.