DNS Blocklists
Introduction
Wiki Markup
SpamAssassin includes support for many of the bigger DNSBLs, with optimal scores (or at least, optimal as determined by the GeneticAlgorithm).
...
To implement DNS Blocklists, it is heavily recommended to run your own CachingNameserver
SpamAssassin Policy for DNSBL Inclusion
The SpamAssassin Policy for DNSBL Inclusion is available at DnsBlocklistsInclusionPolicy
Block Lists
Support for the following DNSBLs is built-in, and shipped in the default configuration.DSBL
- Mailspike http://
...
...
- net/ Mailspike has a few components: in the sense of blacklists Mailspike has a blacklist and a zombie-list (participants of current spam waves).
- SORBS http://www
...
- .sorbs.net/ Note: most zones are included except the actual spam zone due to a $50 delisting fee. You can enable it manually it desired.
- SpamCop http://www.spamcop.net/ SpamCop accepts (automatic) submissions and sends abuse mail in your behalve. SA has a plugin for reporting.
- Spamhaus ZEN http://www.
...
...
- org/zen/ NOTE: Spamhaus is enabled as a "free for most" provider. See: http://www.spamhaus.org/
...
- SURBL http://www.
...
...
- org/ NOTE: SURBL is enabled as a "free for most" provider. See: http://www.
...
...
- URIBL http://www.uribl.com/ NOTE: URIBL is enabled as a "free for most" provider. See: http://www.uribl.com/about.shtml.
Policy Lists
The following DNSBLs are not specifically about spam, but instead abou't sites which break net policies and conventions... practices which are often associated with spammers.
...
- Validity
...
...
- NOTE: Validity is enabled as a "free for most" provider..
Reputation
The following DNS checks have diverse levels of reputation:
- Mailspike http://www.
...
...
- net/ Mailspike has a reputation list of 10 different levels between a good and bad reputation. The top and bottom define their white and blacklists.
Whitelists
The following dns DNS checks are actually for WHITE lists, or sites which are certified by someone to be a reasonable sender.
Bonded Sender Program Trusted sender in Bonded Sender ProgramBR IADB Vouched ISIPP Vouched for SenderBR Habeas Accredited Senders Habeas accreddited senderBR
Accuracy
...
- DNSWL http://www.dnswl.org/ NOTE: DNSWL is enabled as a "free for most" provider. See http://www.dnswl.org/license.
- ISIPP Accreditation Database (IADB) http://www.isipp.com/email-accreditation/
- Mailspike http://www.mailspike.net/
- Sender Score Certified & Sender Score Safe List http://www.senderscorecertified.com/ (formerly Ironport Bonded Sender & Habeas Safelist)
URIBLs
The following DNS checks are for URI's (eg http links).
- Spamhaus http://www.spamhaus.org/dbl/ Checking for spamvertized/phishing/malware/botnet/abused redirector sites. Also checking for NS and A records.
Other Lists
Other places to find out about DNS blacklists / blocklists:
- Wikipedia on DNSBLs http://wikipedia.org/wiki/DNSBL
- Dr. Jørgen Mash's DNS database list checker http://moensted.dk/spam/
- List of All Known DNS-based Spam Databases (blacklistsWeekly Blacklist Statistics (including hit rate and false positive rate) http://www.decludeintra2net.com/junkmailen/support/ip4r.htmCurrent Blacklist Comparison (note: no statistics for false positive rates) http://www.sdsc.edu/~jeff/spam/cbc.html antispam/
Note that it's extremely important to compare false positive rates (nonspam messages marked as spam), as well as spam hit-rates, when evaluating any anti-spam system, include DNS blocklists. (For example, a blocklist that returned a match for every single mail would 'catch all the spam', but would also mark every nonspam mail too.) Some of the above pages omit this information, so take with a pinch of salt.
| Wiki Markup |
|---|
\[http://www.blocklisting.com/faq.html news.admin.net-abuse.blocklisting\] is a newsgroup devoted to discussion of subjects related to the use, administration, and effects of blocklists in ameliorating the problem of unsolicited bulk email and other unwanted or abusive network traffic. It is also accessible through \[http://groups.google.com/groups?group=news.admin.net-abuse.blocklisting groups.google.com\]. |
Questions And Answers
| Anchor | ||||
|---|---|---|---|---|
|
A: DNS-Blocklists often run on the "free for some" model and/or they may limit the number of queries you can perform to maximize resources.
If you were directed to this link from a rule description, then you have a DNS-Blocklist that is purposefully blocking your queries.
Resolving the block might be as simple as using your own non-forwarding caching nameserver to avoid being lumped together with other users queries; setting up your own mirror of the DNS-blocklist; or paying to use the blocklist. The choice is up to the DNS-Blocklist administrator.
SpamAssassin supports the "free for some" model since it works for the majority of SpamAssassin installations. However, we do not support methodologies that purposefully return wrong answers and those DNS-Blocklists will be disabled by default.
The following blocklist providers have implemented a Block Notification Rule with SpamAssassin:
- URIBL http://www.uribl.com/ (rule URIBL_BLOCKED)
- DNSWL http://www.dnswl.org/ (rule RCVD_IN_DNSWL_BLOCKED)
- Spamhaus http://www.spamhaus.org/
- SURBL http://www.surbl.org/ (rule SURBL_BLOCKED)
- Validity http://www.validity.com (rule VALIDITY_BLOCKED)
...
Q: This documentation doesn't seem to cover how to configure dnsDNS-blocklistsBlocklists. It says "Support for these is built-in" but I can't believe that all free BL's is called each time a mail is beeing checked. There must be a way to configure which to use.
Wiki Markup
If you don't want any DNSBLs used, put a line like
skip_rbl_checks 1
in your local.cf
To eliminate the use of a particular DNSBL, set the score to zero. Put lines like
score RCVD_IN_RFCI 0
...
score RCVD_IN_ORBS 0
...
score RCVD_IN_DSBL 0
...
in your local.cf if you don't want certain DNSBLs listed with RCVD_IN_\* \[http://old.spamassassin.org/full/2.6x/dist/rules/* in 50_scores.cf to be used.
Note: many of the DNSBLs that can return multiple lists with one DNS query are implemented using one, unscored, rule that triggers the DNS lookup and stores the result, and several scored rules that check against that stored result (ie: zen.spamhaus.org). For these sets, if you wish to completely disable the DNS lookup, you will need to disable this rule. It can be found by looking at 20_dnsbl_tests.cf 50_scores.cf\] to be used. If you don't want _any_ DNSBLs used, put a line like
skip_rbl_checks 1
in your local.cf
, and find the rule implemented using "check_rbl" instead of "check_rbl_sub".
At present, the query trigger rule for SpamHaus looks like this:
header __RCVD_IN_ZEN eval:check_rbl('zen', 'zen.spamhaus.org.')
So to disable it you'd use:
score __RCVD_IN_ZEN 0
To disable all DNSWL rules, use:
score __RCVD_IN_DNSWL 0
NOTE: As from SpamAssassin version 3.4 you may disable queries for any BL by adding: (local.cf)
dns_query_restriction deny bldomain
for example:
dns_query_restriction deny sorbs.net
Q: The dns-blocklists just don't appear to be used. What is going wrong?
...
A: Third, if your email gateway is behind a firewall make sure that SpamAssassin is resolving the gateway to it's its external address. If SpamAssassin resolves the gateway to an private IP or can't resolve the name at all, it may mark the sending system as a trusted relay. As a result, some or all of the spammer's systems will not be checked against the DNSBL. (I'm not aware of anyway to specify 'last trusted relay' in SA).
Q. Wouldn't it be a good idea to run a local nameserver anyway? So, you can run caching-nameserver to cache blocklist query results.
- Yes! In fact, doing this is important to avoid false results from some DNS lists (e.g. DNSWL) if you have a large ISP and, if you're running a busy mailserver, this is essential for efficiency. See CachingNameserver.
Wiki Markup
- See RelayCountryPlugin.