Versions Compared

Old Version 35

changes.mady.by.user ASF Infrabot

Saved on

compared with

New Version 36

changes.mady.by.user ASF Infrabot

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: [Original edit by Dave]

...

No Format
dnscache-conf dnscache dnslog /service/dnscache 127.0.0.1

rbldnsd

rbldnsd Rbldnsd is not a small and fast DNS daemon written by Michael Tokarev which is especially made to serve DNSBL zones. This daemon was inspired by Dan J. Bernstein's rbldns program found in the djbdns package. The SURBL links page under "Mirroring RBL zone files locally" references several How-Tos for setting up rbldnsd and rsnyc in different environments including FreeBSD, Solaris, etc. NJABL also has a document about setting up rbldnsd and rsync for use with RBLs.

rbldnsd uses far less memory and CPU, and is much quicker in responding to queries than BIND. Those are reasons why rbldnsd is widely used for public and private mirroring of RBL zone files. A common rule of thumb is that the overhead of doing rbldnsd and rsync becomes worthwhile for mail systems that process more than 100,000 messages per day. Some RBLs impose a minimum daily message count before allowing rsync access for local mirroring of their zone files. Some RBLs charge a subscription fee for access. Others don't. Please check with the RBL operators as appropriate.

...

recursive caching DNS server. It is an authoritative DNS server primarily used to host private/internal zones from feeds like Spamhaus, Invaluement, SORBS, etc. Typically rbldnsd will listen on an alternate port then the primary DNS server setup above would forward specific zones to rbldnsd.

Rbldnsd is a little tricky to get setup but once you do it is rock solid. You simply wget, curl, rsync the feed files and rbldnsd can detect changes then automatically reload them.

Search the Internet for current articles for your specific OS. Here's the basic setup on a systemctl-based OS taken from CentOS 7:

  1. Rsync the feed files into /var/lib/rbldnsd
  2. List the feed files in /etc/systemd/system/rbldnsd-dsbl.service
    No Format
    
.include /etc/systemd/rbldnsd.conf

[Unit]
Description=DNSBL (rbldnsd) dsbl instance

[Service]
ExecStart=/sbin/rbldnsd -n -f -r /var/lib/rbldnsd -b 127.0.0.1/530 dul.dnsbl.sorbs.net:ip4set:dul.dnsbl.sorbs.net http.dnsbl.sorbs.net:dnset:http.dnsbl.sorbs.net smtp.dnsbl.sorbs.net:ip4set:smtp.dnsbl.sorbs.net new.spam.dnsbl.sorbs.net:ip4set:new.spam.dnsbl.sorbs.net dnsbl-1.uceprotect.net:ip4set:dnsbl-1.uceprotect.net
  3. Enable and start the service
    No Format
    
systemctl enable rbldnsd-dsbl
systemctl start rbldnsd-dsbl
  4. rbldnsd should now be listening on port 530
    No Format
    
# netstat -tunlap | grep rbldns
udp        0      0 127.0.0.1:530           0.0.0.0:*                           901/rbldnsd
  5. Setup your main DNS caching server to forward to rbldnsd. This is an example for PowerDNS recursor:
    • /etc/pdns-recursor/recursor.conf
      No Format
      
forward-zones-file=/etc/pdns-recursor/forward-zones
    • /etc/pdns-recursor/forward-zones
      No Format
      
dul.dnsbl.sorbs.net=127.0.0.1:530
http.dnsbl.sorbs.net=127.0.0.1:530
smtp.dnsbl.sorbs.net=127.0.0.1:530
new.spam.dnsbl.sorbs.net=127.0.0.1:530
dnsbl-1.uceprotect.net=127.0.0.1:530

Using the Local Caching Nameserver

...

NOTE: Make sure DHCP is not changing the nameserver setting in the /etc/resolv.conf away from 127.0.0.1.

Testing the Local Caching Nameserver

Use dig to test DNS queries. If you don't get a response then the local DNS server could:

  1. not have proper connectivity outbound to the Internet - a firewall could be blocking UDP/TCP 53
  2. have reached the free usage limit of the DNSBlockList - remove the "+short" to see more detail in the ANSWER section
  3. may not be configured correctly - search for articles on how to setup your specific DNS caching server on your specific OS

Spamhaus Zen:

No Format

dig +short 2.0.0.127.zen.spamhaus.org
127.0.0.10
127.0.0.4
127.0.0.2

SORBS DUL:

No Format

# dig 2.0.0.127.dul.dnsbl.sorbs.net +short
127.0.0.10

URIBL:

No Format

dig test.uribl.com.multi.uribl.com txt +short
"permanent testpoint"

If you don't get the permanent testpoint response above, then you are most likely also hitting the URIBL_BLOCKED rule. Check your mail logs. If you are a major mail filtering provider with high volume, then you may have to disable the following rules in the local.cf or you might just get an email from them with pricing information:

No Format

score URIBL_BLACK 0
score URIBL_GREY 0
score URIBL_RED 0