DNS Blacklist - How do I tell if it's working

HCL Domino Domino Forum
1

I’ve set up SPAM blocking as follows:

Created Server Config doc.

Under SMTP Inbound controls:

DNS Blacklist fileters: Enabled

DNS Blacklist sites: bl.spamcop.net; sbl.spamhaus.org; list.dsbl.org; relays.ordb.org; blackholes.mail-abuse.org

Desired action: Log and reject message

Customer SMTP message: Your host %s was found at the DNS blacklist site at %s.

I’ve bounced the server. We’ve been running with this config for several weeks with no noticeable change in SPAM volume. I’ve also looked at Mail Routing events and Misc events in the log and found nothing. Do I have a config problem or sites listed incorrectly?

How can I tell if this is working?

Thanks!

2

Subject: DNS Blacklist - How do I tell if it’s working

At the console do ‘sh st smtp’.

You should see stuff like:

SMTP.DNSBL.bl.spamcop.net.Hits = 4

SMTP.DNSBL.bl.spamcop.net.[200.171.147.150].Hits = 1

SMTP.DNSBL.bl.spamcop.net.[209.150.72.198].Hits = 1

SMTP.DNSBL.bl.spamcop.net.[218.58.70.19].Hits = 1

SMTP.DNSBL.bl.spamcop.net.[66.239.3.68].Hits = 1

SMTP.DNSBL.sbl.spamhaus.org.Hits = 5

SMTP.DNSBL.sbl.spamhaus.org.[209.236.60.143].Hits = 1

SMTP.DNSBL.sbl.spamhaus.org.[63.172.198.78].Hits = 1

SMTP.DNSBL.sbl.spamhaus.org.[64.253.199.173].Hits = 1

SMTP.DNSBL.sbl.spamhaus.org.[66.232.53.79].Hits = 1

SMTP.DNSBL.sbl.spamhaus.org.[66.236.48.34].Hits = 1

SMTP.DNSBL.TotalHits = 9

SMTP.MessagesProcessed = 75

3

Subject: DNS Blacklist - How do I tell if it’s working

Open the Log on the server under Mail Routing Events and look for DNS blacklist. Here is some of mine below. This works great for me. Also here is a few other DNS Blacklist that I have configured to use. Let me know if you find others.

bl.spamcop.net; sbl.spamhaus.org; list.dsbl.org; relays.ordb.org; blackholes.mail-abuse.org; dnsbl.njabl.org

02/16/2003 10:19:48 PM SMTP Server: Remote host 209.150.72.190 (nh90.fyispecials.com) found in DNS blacklist at bl.spamcop.net

02/16/2003 10:19:48 PM SMTP Server: Message from 209.150.72.190 (nh90.fyispecials.com) rejected by DNS blacklist filter

02/16/2003 10:19:48 PM SMTP Server: nh90.fyispecials.com (209.150.72.190) connected

02/16/2003 10:19:53 PM SMTP Server: nh90.fyispecials.com (209.150.72.190) disconnected. 0 message[s] received

02/17/2003 01:05:27 AM SMTP Server: Remote host 4.60.70.27 (lsanca1-ar8-4-60-070-027.lsanca1.dsl-verizon.net) found in DNS blacklist at bl.spamcop.net

02/17/2003 01:05:27 AM SMTP Server: Message from 4.60.70.27 (lsanca1-ar8-4-60-070-027.lsanca1.dsl-verizon.net) rejected by DNS blacklist filter

02/17/2003 01:05:27 AM SMTP Server: lsanca1-ar8-4-60-070-027.lsanca1.dsl-verizon.net (4.60.70.27) connected

02/17/2003 01:05:30 AM SMTP Server: lsanca1-ar8-4-60-070-027.lsanca1.dsl-verizon.net (4.60.70.27) disconnected. 0 message[s] received

4

Subject: RE: DNS Blacklist - How do I tell if it’s working

Is there any site that lists legitimate DNS blacklists sites. I ask because some hotshot engineer said that BL.SPAMCOP.NET is not a real production site

5

Subject: DNS Blacklist - How do I tell if it’s working

Use the spamhaus or ordb test services

6

Subject: RE: DNS Blacklist - How do I tell if it’s working

Thanks for the responses.

However, I’m still not having much luck. After running DNSBL functions for several weeks, we’ve receive a good deal of spam and the “sh st smtp” command does not give me any of the DNSBL stats.

Should the DNSBL stats appear even if no SPAM was blocked?

It is possible that I need to open up a TCPIP port for the DNSBL service to use?

Thanks!

-Adam

7

Subject: RE: DNS Blacklist - How do I tell if it’s working

Should the DNSBL stats appear even if no SPAM was blocked?

No - stats are only reported when there is something to report. No DNSBL activity - no stats.

It is possible that I need to open up a TCPIP port for the DNSBL service to use?

Doubt it. DNSBL is just a DNS lookup. If your Domino host can do DNS lookups (and if it delivers outbound mail, then it must do), then DNSBL should work.

To debug further you need to descibe yout set-up more fully.

  • what server OS?

  • firewall?

  • inbound MX topology? (is inbound mail delivered directly to your Domino host, or via a relay host somewhere)?

  • DNSBL settings - log only, log and tag, log and reject?

  • have you tried the test services offered by ORDB and Spamhaus?

Let me know.