Deploying to Your Mail Servers
Configure your mail servers (Dovecot, Postfix, Nginx) to report banned IPs directly to TestOneMail RBL alongside AbuseIPDB.
1. Download Action File
sudo curl -sSL https://blocklist.testonemail.com/testonemail.conf -o /etc/fail2ban/action.d/testonemail.conf
2. Recommended: Direct Action (No Macro Interpolation Errors)
Edit /etc/fail2ban/action.d/testonemail.conf and set your API key in [Init]:
[Init]
testonemail_apikey = YOUR_SERVER_API_KEY
Then in any jail in /etc/fail2ban/jail.local (e.g. [dovecot], [postfix]), simply append testonemail:
[dovecot]
action = nftables-multiport[name=dovecot, port="80,443,25,587,465,110,995,143,993,4190", protocol=tcp]
banned_db[name=dovecot, port="80,443,25,587,465,110,995,143,993,4190", protocol=tcp]
%(action_abuseipdb)s[abuseipdb_category="18"]
testonemail
[postfix]
action = nftables-multiport[name=postfix, port="80,443,25,587,465,110,995,143,993,4190", protocol=tcp]
banned_db[name=postfix, port="80,443,25,587,465,110,995,143,993,4190", protocol=tcp]
%(action_abuseipdb)s[abuseipdb_category="18,11"]
testonemail
Alternative: Macro Style with %(action_testonemail)s
If using %(action_testonemail)s, both testonemail_apikey and action_testonemail must be declared at the top of /etc/fail2ban/jail.local under [DEFAULT] so all jails can interpolate it:
[DEFAULT]
testonemail_apikey = YOUR_SERVER_API_KEY
action_testonemail = testonemail[testonemail_apikey="%(testonemail_apikey)s"]