Page History

...

Support for the following DNSBLs is built-in, and shipped in the default configuration.

• Mailspike http://www.mailspike.net/ Mailspike has a few components: in the sense of blacklists Mailspike has a blacklist and a zombie-list (participants of current spam waves).

• SORBS http://www.sorbs.net/ Note: most zones are included except the actual spam zone due to a $50 delisting fee. You can enable it manually it desired.

• SpamCop SPAMCOP http://www.spamcop.net/ SpamCop accepts (automatic) submissions and sends abuse mail in your behalve. SA has a plugin for reporting.

• Spamhaus ZEN http://www.spamhaus.org/zen/ NOTE: Spamhaus is enabled as a "free for most" provider. See: http://www.spamhaus.org/organization/dnsblusage.html.

...

• URIBL http://www.uribl.com/ NOTE: URIBL is enabled as a "free for most" provider. See: http://www.uribl.com/about.shtml.

Reputation

The following DNS checks have diverse levels of reputation:

• Mailspike http://www.mailspike.net/ Mailspike has a reputation list of 10 different levels between a good and bad reputation. The top and bottom define their white and blacklists.

Whitelists

The following DNS checks are actually for WHITE lists, or sites which are certified by someone to be a reasonable sender.

• DNSWL http://www.dnswl.org/ NOTE: DNSWL is enabled as a "free for most" provider. See http://www.dnswl.org/license.

• ISIPP Accreditation Database (IADB) http://www.isipp.com/email-accreditation/
• Mailspike http://www.mailspike.net/
• Sender Score Certified & Sender Score Safe List http://www.senderscorecertified.com/ (formerly Ironport Bonded Sender & Habeas Safelist)ISIPP Accreditation Database (IADB)

URIBLs

The following DNS checks are for URI's (eg http links).

• Spamhaus http://www.isipp.com/email-accreditation/spamhaus.org/dbl/ Checking for spamvertized/phishing/malware/botnet/abused redirector sites. Also checking for NS and A records.

Other Lists

Other places to find out about DNS blacklists / blocklists:

• Wikipedia on DNSBLs http://wikipedia.org/wiki/DNSBL
• Dr. Jørgen Mash's DNS database list checker http://moensted.dk/spam/
• List of All Known DNS-based Spam Databases (blacklists) http://www.declude.com/junkmail/support/ip4r.htm
  
• Wikipedia on DNSBLs http://wikipedia.org/wiki/DNSBL
  
• Weekly Blacklist Statistics (including hit rate and false positive rate) http://www.intra2net.com/en/support/antispam/

Note that it's extremely important to compare false positive rates (nonspam messages marked as spam), as well as spam hit-rates, when evaluating any anti-spam system, include DNS blocklists. (For example, a blocklist that returned a match for every single mail would 'catch all the spam', but would also mark every nonspam mail too.) Some of the above pages omit this information, so take with a pinch of salt.

...

• URIBL http://www.uribl.com/ (rule URIBL_BLOCKED)
• DNSWL http://www.dnswl.org/ (rule RCVD_IN_DNSWL_BLOCKED)
• Spamhaus http://www.spamhaus.org/
• SURBL http://www.surbl.org/ (rule SURBL_BLOCKED)

Q: This documentation doesn't seem to cover how to configure DNS-Blocklists. It says "Support for these is built-in" but I can't believe that all free BL's is called each time a mail is beeing checked. There must be a way to configure which to use.

A: You're right. You might look at the Mail::SpamAssassin::Conf documentation page which I admit doesn't really say how to configure which DNSBL to use, or the rules file 20_dnsbl_tests.cf, for internal details, but no clear examples of how to configure the inclusion of various DNSBLs either. For the latest list of DNSBLs you want to be using a recent SpamAssassin version (3.24.x 1 at the time of this correction) and sa-update, for the same reason that you wouldn't use an out-of-date virus scanner, but that also doesn't really have anything to do with the question.

If you don't want any DNSBLs used, put a line like

• skip_rbl_checks 1

in your local.cf

To eliminate the use of a particular DNSBL, set the score to zero. Put lines like

• score RCVD_IN_RFCI 0 score RCVD_IN_ORBS 0 score RCVD_IN_DSBL 0

in your local.cf if you don't want certain DNSBLs listed with RCVD_IN_* in 50_scores.cf to be used.

...

• header __RCVD_IN_ZEN eval:check_rbl('zen', 'zen.spamhaus.org.')

So to disable it you'd use:

• score __RCVD_IN_ZEN 0

To disable all DNSWL rules, use:

• score __RCVD_IN_DNSWL 0

NOTE: As from SpamAssassin version 3.4 you may disable queries for any BL by adding: (local.cf)

...

1. Yes! In fact, doing this is important to avoid false results from some DNS lists (e.g. DNSWL) if you have a large ISP and, if you're running a busy mailserver, this is essential for efficiency. See CachingNameserver.

Q: I'd like to penalize certain countries from which I get a lot of spam and almost no real mail. I can't seem to get it working with multiple countries.

...