SURBL filtering configuration

September 25, 2023 by Roberto Puzzanghera 32 comments

SURBLs are lists of web sites that have appeared in unsolicited messages. Unlike most lists, SURBLs are not lists of message senders.

Web sites seen in unsolicited messages tend to be more stable than the rapidly changing botnet IP addresses used to send the vast majority of them. Sender lists like zen.spamhaus.org can be used in a first stage filter to help identify 80% to 90% of unsolicited messages. SURBLs can help find about 75% of the otherwise difficult, remaining unsolicited messages in a second stage filter. Used together with sender lists, SURBLs have proven to be a highly-effective way to detect 95% of unsolicited messages.

The SURBL filter is part of the DKIM patch by Manvendra Bhangui and it's embedded in my combined patch.

Author: Manvendra Bhangui
Version: 1.48
ANNOUNCE
Original patch

Changelog

Sep 26, 2023
-surblfilter logs the rejected URL in the qmail-smtpd log. It can now inspect both http and https URLs.
-Improvements in man dkim.9, qmail-dkim.9 and surblfilter.9
May 17, 2023
-Top level domains URL is changed. The update_tlds.sh script has been adjusted accordingly

If you followed the 'quick configuration' based on the config-all script, the SURBL feature was already configured for you at that time.

To enable this filter you must export the variable SURBL with any value in your run file and pass the filter program to the QMAILQUEUE variable so that it can be executed before the delivery:

export SURBL=1
export QMAILQUEUE=/var/qmail/bin/surblqueue
export SURBLQUEUE=/var/qmail/bin/simscan

Actually the program is wrapped by surblqueue, as you can see. SURBLQUEUE will make the program to execute simscan when finished. If you don't define SURBLQUEUE the program executes qmail-queue to do the delivery.

NB: Remember to remove QMAILQUEUE from your tcp.smtp, otherwise it will overwrite your run file.

Be aware that the directory /var/qmail/control/cache must have the write priviledges for the user who runs qmail-smtpd, vpopmail in our case. I have adjusted my combined patch accordingly.

surblfilter requires two control files level2-tlds and level3-tlds in /var/qmail/control. The same can be obtained from the surbl.org website http://www.surbl.org/tld/three-level-tlds http://www.surbl.org/tld/two-level-tlds. These files sholud not be confused with the SURBL lists themselves but it is worth to update them monthly or so by building a cronjob like this:

cat > /usr/local/bin/update_tlds.sh << __EOF__
#!/bin/sh
#
wget -O /var/qmail/control/level3-tlds https://www.surbl.org/static/three-level-tlds 
wget -O /var/qmail/control/level2-tlds https://www.surbl.org/static/two-level-tlds
__EOF__
chmod +x /usr/local/bin/update_tlds.sh

Now setup the cronjobs (the second one cleans the cache folder once a day):

cat >> /etc/cron.d/qmail << EOF
# surbl tlds update
2 2 23 * * /var/qmail/bin/update_tlds 1> /dev/null
# surbl cache purge
2 9 * * * find /var/qmail/control/cache/* -cmin +5 -exec /bin/rm -f {} \;
EOF

Be aware that at least on RedHat like OS the cronjob must hold the user who runs the job, so the same cronjobs must as follows:

cat >> /etc/cron.d/qmail << EOF
# surbl tlds update
2 2 23 * * root /var/qmail/bin/update_tlds 1> /dev/null
# surbl cache purge
2 9 * * * root find /var/qmail/control/cache/* -cmin +5 -exec /bin/rm -f {} \;
EOF

Executing `surblfilter`, `qmail-dkim` and `simscan` in cascade

Using a combination of QMAILQUEUE, SURBLQUEUE and DKIMQUEUE will make you run both filters and finally pass the message to simscan, which in turn calls clamd, spamd and finally executes qmail-queue:

export SURBL=1  # Comment to disable SURBL filtering
export QMAILQUEUE=/var/qmail/bin/surblqueue # executes surblfilter
export SURBLQUEUE=/var/qmail/bin/qmail-dkim # executes qmail-dkim afer surblfilter
export DKIMQUEUE=/var/qmail/bin/simscan # simscan is executed after qmail-dkim
export DKIMKEY=/var/qmail/control/domainkeys/%/default
# DKIM verification. Use carefully
export DKIMVERIFY="FGHKLMNOQRTVWp"
# This is to allow msg without "subject" in the h= list
export UNSIGNED_SUBJECT=1
# This is to avoid verification of outgoing messages
export RELAYCLIENT_NODKIMVERIFY=1

Testing

Send yourself an email with an URL such as http://surbl-org-permanent-test-point.com/ in the body. You should see the filter in action in your qmail-smtpd log:

qmail-smtpd: message rejected (message contains an URL listed in SURBL blocklist): user@domain.xy from 123.45.67.89 to yourself@yourdomain.xy helo yourmailserver.xy

DKIM

Limiting outgoing emails

add a comment

Comments

SURBL working, but wrong result when filter

Pablo Murillo November 8, 2023 18:39 CET

I'm testing how works SURBL , and I found that when a URL is found (I'm using the test url), qmail return an error

451 qq temporary problem (#4.3.0)

The mail is rejected, but !, something is not working :(

Any idea what could be happening ?

Txs

SURBL filtering configuration

Changelog

Executing surblfilter, qmail-dkim and simscan in cascade

Testing

Comments

qmail notes

LXC scripts

Other contents

Recent comments

Recent posts

Executing `surblfilter`, `qmail-dkim` and `simscan` in cascade