You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by Apache Wiki <wi...@apache.org> on 2013/12/09 16:53:56 UTC
[Spamassassin Wiki] Update of "DnsBlocklists" by axb
Dear Wiki user,
You have subscribed to a wiki page or wiki category on "Spamassassin Wiki" for change notification.
The "DnsBlocklists" page has been changed by axb:
https://wiki.apache.org/spamassassin/DnsBlocklists?action=diff&rev1=77&rev2=78
= DNS Blocklists =
-
== Introduction ==
-
DNS Blocklists are a common form of network-accessible database used in spam detection. They're also referred to as "DNSBLs", "DNS Blacklists" and "RBLs". (The latter usage is incorrect; see [[RBL]].)
- SpamAssassin includes support for many of the bigger DNSBLs, with optimal scores (or at least, optimal as determined by the GeneticAlgorithm).
+ SpamAssassin includes support for many of the bigger DNSBLs, with optimal scores (or at least, optimal as determined by the GeneticAlgorithm).
To implement DNS Blocklists, it is heavily recommended to run your own CachingNameserver
== SpamAssassin Policy for DNSBL Inclusion ==
-
The SpamAssassin Policy for DNSBL Inclusion is available at DnsBlocklistsInclusionPolicy
=== Black Lists ===
-
Support for the following DNSBLs is built-in, and shipped in the default configuration.
* '''AHBL''' http://www.ahbl.org/ <<BR>>
+
* '''NJABL''' http://www.njabl.org/ <<BR>>
+
* '''SORBS''' http://www.sorbs.net/ <<BR>>
+
* '''SPAMCOP''' http://www.spamcop.net/ <<BR>>
+
* '''Spamhaus PBL+SBL+XBL''' http://www.spamhaus.org/ NOTE: ''Spamhaus is enabled as a "free for most" provider.'' See: http://www.spamhaus.org/organization/dnsblusage.html. <<BR>>
+
* '''SURBL''' http://www.surbl.org/ NOTE: ''SURBL is enabled as a "free for most" provider.'' See: http://www.surbl.org/usage-policy. <<BR>>
+
* '''Trend Micro''' http://www.mailabuse.org/ NOTE: ''Mail Abuse aka MAPS is now TrendMicro Email Reputation Services aka RBL+. This is a commercial product and is no longer enabled by default.'' <<BR>>
+
* '''URIBL''' http://www.uribl.com/ NOTE: ''URIBL is enabled as a "free for most" provider.'' See: http://www.uribl.com/about.shtml. <<BR>>
=== Policy Lists ===
-
The following DNSBLs are not specifically about spam, but instead about sites which break net policies and conventions... practices which are often associated with spammers.
* '''Combined Bogon IP/Hijacked IP/Invalid Whois/''' http://www.completewhois.com/bogons/index.htm <<BR>>
=== Whitelists ===
-
The following DNS checks are actually for WHITE lists, or sites which are certified by someone to be a reasonable sender.
* '''DNSWL''' http://www.dnswl.org/ NOTE: ''DNSWL is enabled as a "free for most" provider.'' See http://www.dnswl.org/license. <<BR>>
+
* '''Sender Score Certified & Sender Score Safe List''' http://www.senderscorecertified.com/ (formerly Ironport Bonded Sender & Habeas Safelist) <<BR>>
+
* '''ISIPP Accreditation Database''' (IADB) http://www.isipp.com/email-accreditation/
== Accuracy ==
Live accuracy figures for most of the DNSBLs used in SpamAssassin, based on the Oct 2003 mail feed for one user, can be found [[http://taint.org/2003/11/07/184247a_mail.html|here]].<<BR>>
== Other Lists ==
-
Other places to find out about DNS blacklists / blocklists:
* Spamlinks http://spamlinks.net/filter-dnsbl.htm
+
* Dr. Jørgen Mash's DNS database list checker http://moensted.dk/spam/
+
* List of All Known DNS-based Spam Databases (blacklists) http://www.declude.com/junkmail/support/ip4r.htm
+
* Current Blacklist Comparison (note: no statistics for false positive rates) http://www.sdsc.edu/~jeff/spam/cbc.html
+
* Wikipedia on DNSBLs http://wikipedia.org/wiki/DNSBL
+
* Weekly Blacklist Statistics (including hit rate and false positive rate) http://www.intra2net.com/en/support/antispam/
Note that it's extremely important to compare false positive rates (nonspam messages marked as spam), as well as spam hit-rates, when evaluating any anti-spam system, include DNS blocklists. (For example, a blocklist that returned a match for every single mail would 'catch all the spam', but would also mark every nonspam mail too.) Some of the above pages omit this information, so take with a pinch of salt.
@@ -60, +67 @@
[[http://www.blocklisting.com/faq.html|news.admin.net-abuse.blocklisting]] is a newsgroup devoted to discussion of subjects related to the use, administration, and effects of blocklists in ameliorating the problem of unsolicited bulk email and other unwanted or abusive network traffic. It is also accessible through [[http://groups.google.com/groups?group=news.admin.net-abuse.blocklisting|groups.google.com]].
== Questions And Answers ==
+ <<Anchor(dnsbl-block)>> '''Q: My queries to a DNS-blocklist were blocked. What does this mean?'''
- <<Anchor(dnsbl-block)>>
- '''Q: My queries to a DNS-blocklist were blocked. What does this mean?'''
-
- A: DNS-Blocklists often run on the "free for some" model and/or they may limit the number of queries you can perform to maximize resources.
+ A: DNS-Blocklists often run on the "free for some" model and/or they may limit the number of queries you can perform to maximize resources.
If you were directed to this link from a rule description, then you have a DNS-Blocklist that is purposefully blocking your queries.
@@ -73, +78 @@
SpamAssassin supports the "free for some" model since it works for the majority of SpamAssassin installations. However, we do not support methodologies that purposefully return wrong answers and those DNS-Blocklists will be disabled by default.
The following blocklist providers have implemented a Block Notification Rule with SpamAssassin:
+
* URIBL http://www.uribl.com/
+
* DNSWL http://www.dnswl.org/
-
+
'''Q: This documentation doesn't seem to cover how to configure DNS-Blocklists. It says "Support for these is built-in" but I can't believe that all free BL's is called each time a mail is beeing checked. There must be a way to configure which to use.'''
- A: You're right. You might look at the [[http://spamassassin.apache.org/doc/Mail_SpamAssassin_Conf.html|Mail::SpamAssassin::Conf]] documentation page which I admit doesn't really say how to configure which DNSBL to use, or the rules file [[http://spamassassin.apache.org/dist/rules/20_dnsbl_tests.cf|20_dnsbl_tests.cf]], for internal details, but no clear examples of how to configure the inclusion of various DNSBLs either. For the latest list of DNSBLs you want to be using a recent SpamAssassin version (3.2.x at the time of this correction) and [[RuleUpdates| sa-update]], for the same reason that you wouldn't use an out-of-date virus scanner, but that also doesn't really have anything to do with the question.
+ A: You're right. You might look at the [[http://spamassassin.apache.org/doc/Mail_SpamAssassin_Conf.html|Mail::SpamAssassin::Conf]] documentation page which I admit doesn't really say how to configure which DNSBL to use, or the rules file [[http://spamassassin.apache.org/dist/rules/20_dnsbl_tests.cf|20_dnsbl_tests.cf]], for internal details, but no clear examples of how to configure the inclusion of various DNSBLs either. For the latest list of DNSBLs you want to be using a recent SpamAssassin version (3.2.x at the time of this correction) and [[RuleUpdates|sa-update]], for the same reason that you wouldn't use an out-of-date virus scanner, but that also doesn't really have anything to do with the question.
If you don't want ''any'' DNSBLs used, put a line like
- {{{skip_rbl_checks 1}}}
+ . {{{skip_rbl_checks 1}}}
in your local.cf
To eliminate the use of a particular DNSBL, set the score to zero. Put lines like
+ . {{{score RCVD_IN_RFCI 0}}} {{{score RCVD_IN_ORBS 0}}} {{{score RCVD_IN_DSBL 0}}}
- {{{score RCVD_IN_RFCI 0}}}
-
- {{{score RCVD_IN_ORBS 0}}}
-
- {{{score RCVD_IN_DSBL 0}}}
in your local.cf if you don't want certain DNSBLs listed with RCVD_IN_* in [[http://spamassassin.apache.org/dist/rules/50_scores.cf|50_scores.cf]] to be used.
-
Note: many of the DNSBLs that can return multiple lists with one DNS query are implemented using one, unscored, rule that triggers the DNS lookup and stores the result, and several scored rules that check against that stored result (ie: zen.spamhaus.org). For these sets, if you wish to completely disable the DNS lookup, you will need to disable this rule. It can be found by looking at 20_dnsbl_tests.cf, and find the rule implemented using "check_rbl" instead of "check_rbl_sub".
At present, the query trigger rule for SpamHaus looks like this:
- {{{header __RCVD_IN_ZEN eval:check_rbl('zen', 'zen.spamhaus.org.')}}}
+ . {{{header __RCVD_IN_ZEN eval:check_rbl('zen', 'zen.spamhaus.org.')}}}
So to disable it you'd use:
- {{{score __RCVD_IN_ZEN 0}}}
+ . {{{score __RCVD_IN_ZEN 0}}}
To disable all DNSWL rules, use:
- {{{score __RCVD_IN_DNSWL 0}}}
+ . {{{score __RCVD_IN_DNSWL 0}}}
+
+ '''NOTE: '''As from SpamAssassin version 3.4 you may disable queries for any BL by adding: (local.cf)
+
+ dns_query_restriction deny bldomain
+
+ for example:
+
+ dns_query_restriction deny sorbs.net
'''Q: The dns-blocklists just don't appear to be used. What is going wrong?'''
@@ -119, +129 @@
A: Third, if your email gateway is behind a firewall make sure that SpamAssassin is resolving the gateway to its external address. If SpamAssassin resolves the gateway to an private IP or can't resolve the name at all, it may mark the sending system as a trusted relay. As a result, some or all of the spammer's systems will not be checked against the DNSBL. (I'm not aware of anyway to specify 'last trusted relay' in SA).
-
'''Q. Wouldn't it be a good idea to run a local nameserver anyway? So, you can run caching-nameserver to cache blocklist query results.'''
A. Yes! In fact, doing this is important to ''avoid false results from some DNS lists (e.g. DNSWL) if you have a large ISP'' and, if you're running a busy mailserver, this is ''essential'' for efficiency. See CachingNameserver.
-
'''Q: Does anybody know of a good way to use the [[http://www.cluecentral.net/rbl/showcountries.php|cluecentral.net country lists]]? I'd like to penalize certain countries from which I get a lot of spam and almost no real mail. I can't seem to get it working with multiple countries.'''