Help with Blacklist configuration

HCL Domino Domino Forum
1

The address listed below is from our DNS server not the site that being blacklist. I have check (sbl-xbl.spamhaus.org) for our IP address and it’s not listed. Is there some configuration change that would list the site? This is the only site that I can get to work – I try relays.ordb.org.;

04/27/2004 09:25:16 AM SMTP Server: Remote host 205.235.245.2 (agdns.oag.state.fl.us) found in DNS blacklist at sbl-xbl.spamhause.org

04/27/2004 09:25:23 AM SMTP Server: Remote host 205.235.245.2 (agdns.oag.state.fl.us) found in DNS blacklist at sbl-xbl.spamhause.org

04/27/2004 09:25:23 AM SMTP Server: agdns.oag.state.fl.us (205.235.245.2) connected

04/27/2004 09:25:24 AM SMTP Server: Message 0049BC8B (MessageID: OF2F565D8C.5C1B5C00-ON85256E83.00492263@oag.state.fl.us) received

04/27/2004 09:25:24 AM SMTP Server: agdns.oag.state.fl.us (205.235.245.2) disconnected. 1 message[s] received

04/27/2004 09:25:28 AM SMTP Server: Remote host 205.235.245.2 (agdns.oag.state.fl.us) found in DNS blacklist at sbl-xbl.spamhause.org

Thanks,

Robert

2

Subject: help with Blacklist configuration

Not sure why you would get the message returned that you do, but I suspect the problem is that the domain of the SBL is spelled incorrectly. Try using sbl.spamhaus.org (note no ‘e’ on the end . . .)

3

Subject: RE: help with Blacklist configuration

When I type in (sbl-xbl.spamhaus.org), I do not get any response. I’m also not getting anything relays.ordb.org.

4

Subject: RE: help with Blacklist configuration

I use the following configuration - try any of these, and if none work, check your firewall. bl.spamcop.net; dun.dnsrbl.net ; relays.ordb.org ; list.dsbl.org ; sbl.spamhaus.org ; relays.osirusoft.com

5

Subject: RE: help with Blacklist configuration

What port should be open if this is a firewall issue? I’m able to see entry in the log when I use “sbl-spamhause.org”. Here are some log info:

SMTP.DNSBL.sbl-xbl.spamhause.org.Hits = 1528

SMTP.DNSBL.sbl-xbl.spamhause.org.[205.235.241.19].Hits = 3

SMTP.DNSBL.sbl-xbl.spamhause.org.[205.235.245.2].Hits = 1525

SMTP.DNSBL.sbl.spamhause.org.Hits = 4

SMTP.DNSBL.sbl.spamhause.org.[205.235.245.2].Hits = 4

SMTP.DNSBL.TotalHits = 1532

6

Subject: RE: help with Blacklist configuration

Who is your ISP?

If AT&T, I believe they are currently nulling all DNSBL queries to popular DNSBL sites including spamhaus. Solution - get DNS services from elsewhere or run your own name servers.

Spamhause.org is registered to someone in Hong Kong and has wildcard DNS set up so that any query to any host in spamhause.org will return the same list of 6 IP addresses from a single /24 network block. It is NOT a DNSBL but will behave like one if you query it as one.

A DNSBL type lookup:

nslookup 2.0.0.127.sbl-xbl.spamhause.org

Non-authoritative answer:

Name: 2.0.0.127.sbl-xbl.spamhause.org

Addresses: 64.15.205.182, 64.15.205.183, 64.15.205.202, 64.15.205.132

      64.15.205.155, 64.15.205.180

A non-DNSBL type lookup

nslookup garbage.spamhause.org

Non-authoritative answer:

Name: garbage.spamhause.org

Addresses: 64.15.205.132, 64.15.205.155, 64.15.205.180, 64.15.205.182

      64.15.205.183, 64.15.205.202

Judging by this, any site using sbl-xbl.spamhause.org to block should be denying ALL email and you really should not be using it.

Chris Linfoot

7

Subject: RE: help with Blacklist configuration

Sprint is my ISP.My Domino SMTP server is sitting behind a firewall, do you know of any port/ports that I should open? I have try using other DNSBL, but I get nothing in the log file. Currenly have the following relays.ordb.org; list.dsbl.org; dun.dnsrbl.net. But I only hits from the incorrect (sbl-xbl.spamhause.org), which I’m change to the correct spelling now.

8

Subject: RE: help with Blacklist configuration

I assume you are using DNS servers provided by your ISP?

DNSBL lookups are just DNS (TCP/UDP on port 53). If nslookups work from a command prompt on your machine (and they should otherwise other things will break, like outbound mail routing when the server can’t query DNS for MX or A records) then the firewall is not the problem.

Use a command line test to verify that DNS is working:

nslookup www.ibm.com

You should see an answer.

Now try an simulated DNSBL lookup.

nslookup 2.0.0.127.sbl.spamhaus.org

or

nslookup 2.0.0.127.list.dsbl.org

These should return 127.0.0.2 or something very similar.

If you get an NX domain response (non-existent domain), then the name servers you are querying are not resolving the DNSBL zones for some reason.

9

Subject: RE: help with Blacklist configuration

This is what I get after performing the test from the Domino server.

C:>nslookup www.ibm.com

Non-authoritative answer:

Name: www.ibm.com

Addresses: 129.42.20.99, 129.42.19.99, 129.42.18.99, 129.42.17.99

      129.42.16.99, 129.42.21.99

C:>nslookup 2.0.0.127.sbl.spamhaus.org

Non-authoritative answer:

Name: 2.0.0.127.sbl.spamhaus.org

Address: 127.0.0.2

I set some debug parameter and this is the reponse I’m getting in the log file: There are some posting referring to this, but provide not answer.The ip listed is the firewall, should that be the ip address on e-mail I’m testing?

04/28/2004 12:14:11 PM SMTP Server [10FC:0008-0948] Performing DNSBL filter lookup for 2.XXX.XXX.205.list.dsbl.org

04/28/2004 12:14:11 PM SMTP Server [10FC:0008-0948] DNSBL filter lookup returned status: No address associated with name

04/28/2004 12:14:11 PM SMTP Server [10FC:0008-0948] Performing DNSBL filter lookup for 2.XXX.XXX.205.dun.dnsrbl.net

04/28/2004 12:14:12 PM SMTP Server [10FC:0008-0948] DNSBL filter lookup returned status: No address associated with name

04/28/2004 12:14:12 PM SMTP Server [10FC:0008-0948] Performing DNSBL filter lookup for 2.XXX.XXX.205.sbl-xbl.spamhaus.org

04/28/2004 12:14:12 PM SMTP Server [10FC:0008-0948] DNSBL filter lookup returned status: No address associated with name

04/28/2004 12:14:12 PM SMTP Server [10FC:0008-0948] Performing DNSBL filter lookup for 2.XXX.XXX.205.relays.ordb.org

04/28/2004 12:14:12 PM SMTP Server [10FC:0008-0948] DNSBL filter lookup returned status: No address associated with name

10

Subject: Sounds like your firewall is relaying the message to you rather than letting the inbound SMTP traffic straight through to your server.

11

Subject: Aha!

Do you mean that the host 205.XXX.XXX.2 in the following DNSBL lookups is your own firewall?

04/28/2004 12:14:11 PM SMTP Server [10FC:0008-0948] Performing DNSBL filter lookup for 2.XXX.XXX.205.list.dsbl.org

In that case, the firewall is not a firewall, it is an SMTP relay (just like Bill Ernest says) and it is accepting messages addressed to your Internet domains and relaying them to your Domino server.

DNSBL lookups will never work in this configuration because the lookup is done on the IP of the host connecting to Domino to deliver the mail, which will always be your “firewall”, and never the originiating IP of the message.

Solutions:

  • implement DNSBL checking on the “firewall” if it supports them

  • change your configuration so that your Domino host is itself the first host encountered by external machines attempting to deliver mail to your domains.

Chris Linfoot

12

Subject: Aha! - Thank You!!

I’ve been pulling my hair out trying to get DNSBL’s working and have been perplexed as to why it wasn’t working. Now I know why… our mail is relayed from another SMTP box inside the firewall. Wish the help files would have pointed that out