Thank you, rkhunter and maldet, nothing suspicious
.
Anyway, I think I found it how to define HELO to be only from the main server address for qmail.
/var/qmail/control/outgoingips
should be empty.
If its empty then it sends to HELO settings which is in mail server settings in Kloxo,
otherwise this file looks like this
domain1.com 1.2.3.4
domain2.com 1.2.3.4
domain3.com 1.2.3.4
And it sends HELO for every domain on the same IP address as it is clients domain name, and that can be marked as spam at SPAMHAUS.
More info here:
https://github.com/mamapitufo/qmail-outgoingipsYou can check with sending email to helocheck@abuseat.org,
also some info here:
https://www.abuseat.org/qmailhelp.htmlNow I will see in few days if it will be ok also by Spamhaus and Abuseat.