DNSBL lookup
The check.dnsbl module implements checking of source IP and hostnames against a set of DNS-based Blackhole lists (DNSBLs).
Its configuration consists of module configuration directives and a set of blocks specifing lists to use and kind of lookups to perform on them.
check.dnsbl {
debug no
check_early no
quarantine_threshold 1
reject_threshold 1
# Lists configuration example.
dnsbl.example.org {
client_ipv4 yes
client_ipv6 no
ehlo no
mailfrom no
score 1
}
hsrbl.example.org {
client_ipv4 no
client_ipv6 no
ehlo yes
mailfrom yes
score 1
}
}
Arguments
Arguments specify the list of IP-based BLs to use.
The following configurations are equivalent.
check {
dnsbl dnsbl.example.org dnsbl2.example.org
}
check {
dnsbl {
dnsbl.example.org dnsbl2.example.org {
client_ipv4 yes
client_ipv6 no
ehlo no
mailfrom no
score 1
}
}
}
Configuration directives
Syntax: debug boolean
Default: global directive value
Enable verbose logging.
Syntax: check_early boolean
Default: no
Check BLs before mail delivery starts and silently reject blacklisted clients.
For this to work correctly, check should not be used in source/destination pipeline block.
In particular, this means: - No logging is done for rejected messages. - No action is taken if quarantine_threshold is hit, only reject_threshold applies. - defer_sender_reject from SMTP configuration takes no effect. - MAIL FROM is not checked, even if specified.
If you often get hit by spam attacks, it is recommended to enable this setting to save server resources.
Syntax: quarantine_threshold integer
Default: 1
DNSBL score needed (equals-or-higher) to quarantine the message.
Syntax: reject_threshold integer
Default: 9999
DNSBL score needed (equals-or-higher) to reject the message.
List configuration
dnsbl.example.org dnsbl.example.com {
client_ipv4 yes
client_ipv6 no
ehlo no
mailfrom no
responses 127.0.0.1/24
score 1
}
Directive name and arguments specify the actual DNS zone to query when checking the list. Using multiple arguments is equivalent to specifying the same configuration separately for each list.
Syntax: client_ipv4 boolean
Default: yes
Whether to check address of the IPv4 clients against the list.
Syntax: client_ipv6 boolean
Default: yes
Whether to check address of the IPv6 clients against the list.
Syntax: ehlo boolean
Default: no
Whether to check hostname specified n the HELO/EHLO command against the list.
This works correctly only with domain-based DNSBLs.
Syntax: mailfrom boolean
Default: no
Whether to check domain part of the MAIL FROM address against the list.
This works correctly only with domain-based DNSBLs.
Syntax: responses cidr|ip...
Default: 127.0.0.1/24
IP networks (in CIDR notation) or addresses to permit in list lookup results. Addresses not matching any entry in this directives will be ignored.
Syntax: score integer
Default: 1
Score value to add for the message if it is listed.
If sum of list scores is equals or higher than quarantine_threshold, the message will be quarantined.
If sum of list scores is equals or higher than rejected_threshold, the message will be rejected.
It is possible to specify a negative value to make list act like a whitelist and override results of other blocklists.