THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
...
SpamAssassin includes support for many of the bigger DNSBLs, with optimal scores (or at least, optimal as determined by the GeneticAlgorithm).
To implement DNS Blocklists, it is heavily recommended to run your own CachingNameserver
Black Lists
Support for the following DNSBLs is built-in, and shipped in the default configuration.Spamhaus PBL+SBL+XBL
- AHBL http://www.
...
...
- *DNSWL_ http://www.dnswl.org/ NOTE:_ DNSWL is enabled as a "free for most" provider._ See: http://www.dnswl.org/license. <<BR>
- NJABL* http://www.
...
...
- SORBS* http://www.sorbs.net/
...
- SPAMCOP*
...
- Spamhaus PBL+SBL+XBL* http://www.spamhaus.org/ NOTE:_ Spamhaus is enabled as a "free for most" provider._ See: http://www.
...
...
...
- SURBL*
...
...
- NOTE:_ SURBL is enabled as a "free for most" provider._ See: http://www.
...
...
- Trend Micro* http://www.mailabuse.org/
...
- NOTE:_ Mail Abuse aka MAPS is now TrendMicro Email Reputation Services aka RBL+. This is a commercial product and is no longer enabled by default._
- URIBL* http://www.uribl.com/ NOTE:_ URIBL is enabled as a "free for most" provider._ See: http://www.uribl.com/about.shtml.
Policy Lists
The following DNSBLs are not specifically about spam, but instead about sites which break net policies and conventions... practices which are often associated with spammers.
- Combined Bogon IP/Hijacked IP/Invalid Whois/* http://www.completewhois.com/bogons/index.htm
- RFC Ignorant* http://www.rfc-ignorant.org/
...
- NOTE: RFC Ignorant is controversial. Some administrators may wish to disable or lower the score
...
- for the RFC Ignorant list
...
Whitelists
The following DNS checks are actually for WHITE lists, or sites which are certified by someone to be a reasonable sender.
- DNSWL* http://www.dnswl.org/
...
- NOTE:
...
- _ DNSWL is enabled as a "free for most" provider._ See http://www.dnswl.org/license.
- Sender Score Certified & Sender Score Safe List* http://www.senderscorecertified.com/ (formerly Ironport Bonded Sender & Habeas Safelist)
- ISIPP Accreditation Database* (IADB) http://www.isipp.com/email-accreditation/
- ISIPP Accreditation Database* (IADB) http://www.isipp.com/email-accreditation/
Accuracy
Live accuracy figures for most of the DNSBLs used in SpamAssassin, based on the Oct 2003 mail feed for one user, can be found here.
...
| Anchor | ||||
|---|---|---|---|---|
|
Q: My queries to a DNS-blocklist were blocked. What does this mean?*
A: DNS-Blocklists often run on the "free for some" model and/or they may limit the number of queries you can perform to maximize resources.
...
- URIBL http://www.uribl.com/
- DNSWL http://www.dnswl.org/*
Q: This documentation doesn't seem to cover how to configure DNS-Blocklists. It says "Support for these is built-in" but I can't believe that all free BL's is called each time a mail is beeing checked. There must be a way to configure which to use.*
A: You're right. You might look at the Mail::SpamAssassin::Conf documentation page which I admit doesn't really say how to configure which DNSBL to use, or the rules file 20_dnsbl_tests.cf, for internal details, but no clear examples of how to configure the inclusion of various DNSBLs either. For the latest list of DNSBLs you want to be using a recent SpamAssassin version (3.2.x at the time of this correction) and sa-update, for the same reason that you wouldn't use an out-of-date virus scanner, but that also doesn't really have anything to do with the question.
If you don't want_ any_ DNSBLs used, put a line like
...
So to disable it you'd use:
score __RCVD_IN_ZEN 0*
Q: The dns-blocklists just don't appear to be used. What is going wrong?*
A: First, make sure Net::DNS for perl is installed. Without this the blocklists will not be used.
...
A: Third, if your email gateway is behind a firewall make sure that SpamAssassin is resolving the gateway to its external address. If SpamAssassin resolves the gateway to an private IP or can't resolve the name at all, it may mark the sending system as a trusted relay. As a result, some or all of the spammer's systems will not be checked against the DNSBL. (I'm not aware of anyway to specify 'last trusted relay' in SA).*
Q. Wouldn't it be a good idea to run a local nameserver anyway? So, you can run caching-nameserver to cache blocklist query results.*
- Yes! In fact, doing this is important to_ avoid false results from some DNS lists (e.g. DNSWL) if you have a large ISP_ and, if you're running a busy mailserver, this is_ essential_ for efficiency. See CachingNameserver.
*
Q: Does anybody know of a good way to use the cluecentral.net country lists? I'd like to penalize certain countries from which I get a lot of spam and almost no real mail. I can't seem to get it working with multiple countries._'
- See RelayCountryPlugin.