Realtime Blackhole List (RBL)

Download qmail-dnsbl patch (local copy)
Code and logic from rblsmtpd and qmail-dnsbl patch by Fabio Busatto
Added support for whitelists, TXT and A queries, configurable return codes 451 or 553 with custom messages (by Luca Franceschini)

This patch replaces the djb's rblsmtpd program. It incorporates into qmail-smtpd the rbl stuff with the advantage that you can see the envelope in the logs. Registering the envelope as well as the sender ip is important to always know what happened to not received messages.

An additional improvement with respect to the use of the RBL filter *before* qmail-smtpd as rblsmtpd did is that the authenticated users who want to send messages from a remote dynamic IP will not be banned; this means that we are able to switch on the filter on the 587 submission port as well :)

To activate the rbl check just add your favourite block lists in the dnsbllist control file (one per line).

cat > /var/qmail/control/dnsbllist << __EOF__
-b.barracudacentral.org
-zen.spamhaus.org
__EOF__

Now restart qmail and check that the RBL lists have been parsed:

> qmailctl restart
> qmail-showctl |grep dnsbl
dnsbllist:
List at -b.barracudacentral.org configured for dnsbl check.
List at -zen.spamhaus.org configured for dnsbl check.

Improvements with respect to the original qmail-dnsbl patch

default file control/dnsbllist can be overridden with env variable DNSBLLIST
if DNSBLSKIP env variable is set, qmail-smtpd skips the rbl check
if control/dnsblfailclosed or DNSBLFAILCLOSED are defined, qmail-smtpd considers the source ip as blacklisted even in case of lookup failures (check rblsmtpd man page for more details)
support for environment variable RBLSMTPD (check rblsmtpd man page for more details)
dnsbllist can contain empty lines and comments with '#' at start or end of lines; leading and trailing spaces are automatically removed

Examples and formats

Query rbl for TXT records, return code 451: "451 http://www.spamhaus.org/query/bl?ip=30.50.20.3"

zen.spamhaus.org

Query rbl for TXT records, return code 553: "553 http://www.spamhaus.org/query/bl?ip=30.50.20.3"

-zen.spamhaus.org

Query rbl for A records, custom return message with ret code 451: "451 Message rejected"

zen.spamhaus.org:Message rejected

Query rbl for A records, custom return message with ret code 553: "553 Message rejected", the following syntaxes are allowed:

-zen.spamhaus.org:Message rejected
zen.spamhaus.org:-Message rejected
-zen.spamhaus.org:-Message rejected

Query rbl for A records, custom return message with IP variable, replaced by remote ip:

zen.spamhaus.org:Message blocked from %IP%

dns whitelist A query:

+white.dnsbl.local:Whitelist test
+white.dnsbl.local

The following syntaxes are NOT ALLOWED:

zen.spamhaus.org:
zen.spamhaus.org:-

Howto avoid being "cut off" by spamhaus.org

At the end of this guide I will show how to set up fail2ban in order to ban malicious IPs and then decrease the amount of connections to the RBL lists, avoiding to be banned consequently.

As an alternative, you may be interested to take a look to the idea of Costel Balta, which is addressed to solve the same problem.

Check your IP's reputation

When you buy an IP address, you know that it's not new and you inherit its reputation. So the first thing you may want to do is to check if it's listed in some RBL here: http://multirbl.valli.org or https://mxtoolbox.com/SuperTool.aspx

Add-ons

Greetdelay

add a comment

Comments

dnslist issue

Nic Chua May 27, 2020 10:25

Hi, I have psbl.surriel.com and spamhaus in my dnslist.

[root@brilliance bin]# qmail-showctl |grep dnsbl
dnsbllist:
List at zen.spamhaus.org configured for dnsbl check.
List at sbl.spamhaus.org configured for dnsbl check.
List at pbl.spamhaus.org configured for dnsbl check.
List at xbl.spamhaus.org configured for dnsbl check.
List at bl.spamcop.net configured for dnsbl check.
List at psbl.surriel.com configured for dnsbl check.
List at b.barracudacentral.org configured for dnsbl check.

I noticed that at times listed IPs are not blocked.

Take for example IP 213.142.156.102. This IP was listed multiple times on psbl.surriel.com since 2019 July. But in my log, netqmail still allows it to pass thru

surriel.com
@400000005ece1c472916a37c qmail-smtpd[3241]: rbl: ip=213.142.156.102 query=102.156.142.213.psbl.surriel.com result=ignore message=''

spamhaus
@400000005ece1c4718fd7024 qmail-smtpd[3241]: rbl: ip=213.142.156.102 query=102.156.142.213.zen.spamhaus.org result=ignore message=''
@400000005ece1c47196c915c qmail-smtpd[3241]: rbl: ip=213.142.156.102 query=102.156.142.213.sbl.spamhaus.org result=ignore message=''
@400000005ece1c4719cb7a3c qmail-smtpd[3241]: rbl: ip=213.142.156.102 query=102.156.142.213.pbl.spamhaus.org result=ignore message=''
@400000005ece1c471a3309f4 qmail-smtpd[3241]: rbl: ip=213.142.156.102 query=102.156.142.213.xbl.spamhaus.org result=ignore message=''

My nslookup captured it correctly.

[root@brilliance bin]# nslookup 102.156.142.213.psbl.surriel.com
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: 102.156.142.213.psbl.surriel.com
Address: 127.0.0.2

[root@brilliance bin]# nslookup 102.156.142.213.zen.spamhaus.org
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: 102.156.142.213.zen.spamhaus.org
Address: 127.0.0.3

[root@brilliance bin]# nslookup 102.156.142.213.sbl.spamhaus.org
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: 102.156.142.213.sbl.spamhaus.org
Address: 127.0.0.3

As my volume is not large, i don't think i am blocked.

Any idea what went wrong?

Thanks
nic

Realtime Blackhole List (RBL) - qmail-dnsbl

Improvements with respect to the original qmail-dnsbl patch

Examples and formats

Howto avoid being "cut off" by spamhaus.org

Check your IP's reputation

Comments

qmail notes

Other contents

Recent comments

Recent posts