The reliable way to stop spam on a self-hosted iRedMail server is to layer several controls rather than rely on one switch: publish correct DNS identity records, reject obvious abusive clients at the SMTP front door, score message content with Amavisd and SpamAssassin, apply narrowly scoped iRedAPD policies, and deliver anything classified as spam to Junk for review.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This design blocks much of the abuse before it consumes queue and scanning resources while preserving a recovery path for legitimate messages. The order matters: establish identity first, stage SMTP-time blocking, keep content scanning enabled, then tune exceptions from logs.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What each iRedMail anti-spam layer does
Each component sees a different signal and acts at a different point in delivery. Removing one layer because another is working creates a blind spot.
| Layer | Where it acts | What it contributes | Important limitation |
|---|---|---|---|
| DNS identity | Public DNS and reverse DNS | Lets receiving systems verify that your server is a legitimate sender. | It improves trust but does not itself classify incoming spam. |
| Postscreen | SMTP connection, before normal Postfix processing | Applies DNSBL and protocol checks before suspicious clients can fill the queue. | Changes how port 25 is used; authenticated users must submit on 587 or 465. |
| Postfix DNSBL restrictions | SMTP recipient restrictions | Simple list-based rejection for clients whose IPs appear on selected DNS blocklists. | It provides less protocol defense than postscreen and is sensitive to list response codes and rule placement. |
| Amavisd plus SpamAssassin | Message and content scanning | Scores headers, body and other message signals and adds spam headers in iRedMail’s normal path. | Consumes CPU and requires the correct configuration files and log diagnosis. |
| iRedAPD policy plugins | Policy stage during delivery | Provides precise allow, deny and greylisting decisions for addresses, domains, IPs and networks. | A broad allow rule can bypass filtering for far more mail than intended. |
| Dovecot Sieve | Mailbox delivery | Moves detected spam to Junk so users can recover false positives. | It does not stop SMTP traffic; it acts after a message has been classified. |
1. Establish DNS identity before tuning filters
Do this before changing spam scores or blocklists. iRedMail’s DNS guidance treats an A record and an MX record as required. Reverse PTR, SPF, DKIM and DMARC are highly recommended because remote systems commonly inspect them when deciding whether to accept mail.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Create the required records
- A record: Point the mail hostname used by the server to its public mail IP address.
- MX record: Point each hosted domain’s MX record to that mail hostname. Ensure the hostname resolves back to the same public address.
Add the reputation records
- Reverse PTR: Ask the ISP or hosting provider that controls the public IP to map it to the server’s mail hostname. You normally cannot create this record in your ordinary DNS zone.
- SPF: Publish a policy that authorizes the systems actually allowed to send for each domain. Do not list infrastructure that never sends mail.
- DKIM: Enable the key generated by Amavisd and publish its TXT record at the selector hostname it specifies.
- DMARC: Add this only after SPF and DKIM are passing and aligned with the visible From domain. DMARC is intended to help senders and receivers determine whether a message is legitimately from the claimed sender and what to do when it is not. Starting with an enforcement policy before alignment works can reject legitimate mail.
Check DNS from outside the server and inspect delivery logs for authentication results. A missing PTR or a mismatched SPF, DKIM or DMARC record can look like a spam problem even when your local classifier is correctly configured.
2. Choose the SMTP-time gate
SMTP-time controls reject or defer suspicious clients before normal message processing. iRedMail’s performance guidance identifies postscreen as the preferred front door for a new deployment. A pure Postfix DNSBL configuration is a reasonable fallback when postscreen is unsuitable.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPostscreen: the preferred front door
Postscreen accepts connections on port 25, applies DNSBL and protocol tests, and passes only clients that meet its policy to the normal SMTP service. This keeps many abusive sessions out of the local mail queue and avoids spending Amavisd and SpamAssassin resources on messages that should never be accepted.
Use the postscreen setup script supplied for your iRedMail release, then inspect the generated Postfix and postscreen configuration before reloading the service. Review which DNSBL sites are enabled and confirm that your resolver can answer their queries reliably.
Enabling postscreen changes submission behavior. As the iRedMail documentation states, users must send through port 587 with TLS or port 465 with SSL; port 25 is reserved for mail exchanged between servers, not end-user submission. Update desktop clients, mobile clients, applications and any internal relay that previously used port 25 before enforcing the change.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Postfix DNSBL restrictions: the fallback
If you do not use postscreen, add reject_rbl_client entries to smtpd_recipient_restrictions. Place the DNSBL checks after reject_unauth_destination, and verify the response-code syntax required by each list. The official iRedMail example uses:
Free tools Windows power users keep installed
One-click scans. No signup required.
reject_rbl_client zen.spamhaus.org
reject_rbl_client b.barracudacentral.orgReload Postfix after validating the configuration and watch the mail log for rejected connections. Do not add the same DNSBL path both to postscreen and to recipient restrictions unless you deliberately understand the duplicate checks and their operational cost.
Use a local caching resolver
A busy mail server makes many DNS queries. Run a local caching resolver so repeated lookups are answered locally and DNSBL providers see fewer requests. Free blocklist services can return improper responses when query limits are exceeded; caching reduces that risk but does not remove the provider’s terms or limits. If a list begins returning unusual responses, check query volume and the provider’s documented response codes before treating every result as a confirmed listing.
3. Keep Amavisd and SpamAssassin working together
In a default iRedMail installation, Amavisd calls SpamAssassin. SpamAssassin is normally not a standalone daemon in this design: it is invoked by Amavisd during message processing. SMTP-time blocking and content scoring solve different problems, so do not disable Amavisd, ClamAV or SpamAssassin merely because postscreen or a DNSBL is rejecting obvious abuse.
Use the right configuration files
| Purpose | Debian or Ubuntu | FreeBSD |
|---|---|---|
| Amavisd overrides | /etc/amavis/conf.d/50-user |
Use the Amavisd configuration location supplied by the FreeBSD iRedMail installation. |
| SpamAssassin rules and options | /etc/mail/spamassassin/local.cf |
/usr/local/etc/mail/spamassassin/local.cf |
Keep SpamAssassin options in local.cf and Amavisd-specific settings in the Amavisd override file. Mixing them into the wrong file can leave the service running while silently ignoring your change.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Verify that scoring is occurring
Amavisd activity is recorded through the Postfix mail log. Look for the message’s spam score and the X-Spam-* headers added during scanning. If those headers are missing, first confirm that the message actually passed through Amavisd, then check the relevant configuration file and service logs. To obtain more SpamAssassin detail, enable $sa_debug = 1 in the Amavisd configuration while diagnosing the problem; turn verbose debugging back off after collecting the needed evidence.
When tuning a score or rule, change one thing at a time and test both an obvious spam sample and a known-good message. A lower threshold can catch more unwanted mail but increases the chance that a legitimate message is sent to Junk, which is why delivery to a recoverable folder is safer than silent rejection.
4. Add precise iRedAPD exceptions and greylisting
Whitelist only the smallest necessary target
Use iRedAPD’s amavisd_wblist plugin and the wblist_admin.py administration tool for server-wide, per-domain or per-user exceptions. Supported targets include:
- A complete address such as
[email protected]. - A domain such as
@example.net. - A domain and its subdomains with
@.example.net. - A single sending IP address.
- A CIDR network.
Choose the narrowest target that fixes the false positive. If one partner’s address is being misclassified, allow that address rather than its entire domain. If a provider legitimately uses several documented outbound IPs, allow only those addresses or the smallest CIDR that contains them. A whole-domain or broad-network rule can bypass spam and malware checks for every sender in that scope.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Stage greylisting before enforcing it
Greylisting temporarily rejects a new sender triplet (typically source, recipient and sender) and waits for a retry. iRedAPD 1.7.0 and later support this feature. The documented defaults are:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
| Setting | Default | Meaning |
|---|---|---|
| Retry-block interval | 15 minutes | A retry arriving sooner than this is rejected. |
| Successful-triplet retention | 30 days | A client that retries successfully is remembered for this period. |
| Unsuccessful-triplet retention | 2 days | A triplet that never completes is retained for this period. |
Start in training mode on a new server and observe which legitimate senders retry correctly. Some companies redeliver immediately from a different server or use infrastructure that does not follow conventional retry behavior. Add a targeted whitelist for those senders before enabling strict rejection. Monitor queue delays and user reports during the change window.
5. Deliver detected spam to Junk instead of deleting it
A classifier is not perfect. Sending detected spam to a reviewable Junk folder gives users a recovery path and lets you discover false positives without accepting every message into the inbox.
- Install the global Sieve sample supplied with iRedMail for moving messages marked as spam.
- Set Dovecot’s
sieve_beforeoption to the path of that global rule so it runs before per-user filters. - Make the Sieve file owned by
vmail:vmailand set its permission to0500. - Restart Dovecot and deliver a controlled test message that receives spam headers.
- Confirm that the message arrives in the user’s Junk folder and remains visible for manual recovery.
The exact Sieve sample and header condition should come from your iRedMail installation’s documentation for the installed release. The important distinction is that Sieve acts after Amavisd has classified the message; it cannot replace postscreen, DNSBL checks or content scanning.
6. A staged rollout that avoids delivery failures
Before changing SMTP behavior
- Confirm A, MX and reverse PTR records resolve as intended.
- Verify SPF and DKIM alignment with test messages, then publish DMARC.
- Ensure authenticated submission works on 587/TLS or 465/SSL for every user and application.
- Confirm that a local caching resolver is answering DNSBL queries.
- Record the current Postfix, Amavisd, SpamAssassin, iRedAPD and Dovecot settings so you can revert one layer without undoing the others.
During the rollout
- Enable or adjust one layer at a time, beginning with DNS identity.
- Run postscreen in the documented staged mode, or add the fallback DNSBL rules without changing unrelated recipient restrictions.
- Inspect Postfix logs for rejected clients, DNS errors and unexpected authenticated-user failures.
- Keep Amavisd, ClamAV and SpamAssassin enabled and verify
X-Spam-*headers. - Enable iRedAPD greylisting in training mode, then add only narrowly scoped exceptions.
- Activate the global Sieve rule and test both a spam-classified message and a normal message.
After each change
Check three paths separately: a message from another mail server to a local user, an authenticated user’s submission, and a known-good external sender that previously triggered a false positive. This separates port-25 policy errors from content-scoring errors and from overbroad allow rules.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Troubleshooting common failures
Legitimate users cannot send
After postscreen is enabled, verify that the client is using 587 with TLS or 465 with SSL rather than port 25. Check authentication logs and the submission service configuration. Port 25 should be used by other mail servers, not by end-user mail clients.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Messages are accepted but never receive spam headers
Confirm that Amavisd is in the Postfix content-filter path, that SpamAssassin is installed and enabled, and that settings were placed in the correct platform-specific files. Inspect the Postfix log; enable $sa_debug = 1 temporarily if normal logging does not show why scanning was skipped.
A DNSBL rejects too much or behaves unpredictably
Check the list’s required response-code syntax, rule placement and current query limits. Confirm that your server uses a local caching resolver. Remove or disable a problematic list during diagnosis rather than weakening every other layer.
Greylisting delays an important sender
Look for a retry from the same sender, recipient and source triplet. If the sender changes IPs or does not retry within the 15-minute default, place that specific address or documented sending IP in the iRedAPD allow list. Avoid allowing the entire sender domain unless you control its outbound infrastructure.
Users report missing mail
Search Junk before changing thresholds or adding broad whitelists. Review the message’s spam headers and the Amavisd and Postfix logs, then correct the narrowest rule responsible. Keep the Sieve destination active while tuning so a classification mistake remains reversible.
8. What not to do
- Do not publish DMARC enforcement before SPF and DKIM alignment is verified.
- Do not run postscreen and an equivalent DNSBL recipient-restriction path blindly in parallel.
- Do not whitelist an entire domain or large CIDR block to solve one false positive.
- Do not disable content scanning because SMTP-time blocking is catching obvious spam.
- Do not silently discard all classifier hits before users have a Junk or quarantine review path.
- Do not assume a free DNSBL can be queried without limits or without a caching resolver.
9. Open-source and commercial management options
The open-source iRedMail product includes SpamAssassin, ClamAV, SPF, DKIM, greylisting, whitelisting, blacklisting and SQL quarantine as part of its mail stack. The commercial Enterprise Edition, version 1.8.4 released on September 10, 2026, adds web-managed greylisting, lists, spam policy and quarantine, along with per-domain and per-user anti-spam settings. Both approaches still depend on correct DNS, careful policy scope and log-based tuning; a management interface does not remove those operational requirements.
10. A practical maintenance checklist
- Review Postfix and Amavisd logs for rejected clients, scan failures and unexpected allow-list matches.
- Check DNSBL response errors and resolver cache behavior after traffic or provider changes.
- Audit iRedAPD entries for stale addresses, domains and CIDR ranges.
- Review Junk for false positives and adjust one rule at a time.
- Re-test authenticated submission after every Postfix or postscreen change.
- Keep SPF, DKIM and DMARC records synchronized with any new outbound service.
- Revisit greylisting exceptions when a partner changes its sending infrastructure.
A layered configuration gives each decision a clear owner: DNS establishes identity, postscreen or DNSBLs stop obvious abusive clients, Amavisd and SpamAssassin score content, iRedAPD handles precise policy exceptions, and Dovecot Sieve preserves a recoverable copy for users.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
