maddy

  1# DNSBL lookup
  2
  3The check.dnsbl module implements checking of source IP and hostnames against a set
  4of DNS-based Blackhole lists (DNSBLs).
  5
  6Its configuration consists of module configuration directives and a set
  7of blocks specifying lists to use and kind of lookups to perform on them.
  8
  9```
 10check.dnsbl {
 11    debug no
 12    check_early no
 13
 14    quarantine_threshold 1
 15    reject_threshold 1
 16
 17    # Lists configuration example.
 18    dnsbl.example.org {
 19        client_ipv4 yes
 20        client_ipv6 no
 21        ehlo no
 22        mailfrom no
 23        score 1
 24    }
 25    hsrbl.example.org {
 26        client_ipv4 no
 27        client_ipv6 no
 28        ehlo yes
 29        mailfrom yes
 30        score 1
 31    }
 32}
 33```
 34
 35## Arguments
 36
 37Arguments specify the list of IP-based BLs to use.
 38
 39The following configurations are equivalent.
 40
 41```
 42check {
 43    dnsbl dnsbl.example.org dnsbl2.example.org
 44}
 45```
 46
 47```
 48check {
 49    dnsbl {
 50        dnsbl.example.org dnsbl2.example.org {
 51            client_ipv4 yes
 52            client_ipv6 no
 53            ehlo no
 54            mailfrom no
 55            score 1
 56        }
 57    }
 58}
 59```
 60
 61## Configuration directives
 62
 63### debug _boolean_
 64Default: global directive value
 65
 66Enable verbose logging.
 67
 68---
 69
 70### check_early _boolean_
 71Default: `no`
 72
 73Check BLs before mail delivery starts and silently reject blacklisted clients.
 74
 75For this to work correctly, check should not be used in source/destination
 76pipeline block.
 77
 78In particular, this means:
 79
 80- No logging is done for rejected messages.
 81- No action is taken if `quarantine_threshold` is hit, only `reject_threshold`
 82  applies.
 83- `defer_sender_reject` from SMTP configuration takes no effect.
 84- MAIL FROM is not checked, even if specified.
 85
 86If you often get hit by spam attacks, it is recommended to enable this
 87setting to save server resources.
 88
 89---
 90
 91### quarantine_threshold _integer_
 92Default: `1`
 93
 94DNSBL score needed (equals-or-higher) to quarantine the message.
 95
 96---
 97
 98### reject_threshold _integer_
 99Default: `9999`
100
101DNSBL score needed (equals-or-higher) to reject the message.
102
103## List configuration
104
105```
106dnsbl.example.org dnsbl.example.com {
107    client_ipv4 yes
108    client_ipv6 no
109    ehlo no
110    mailfrom no
111    responses 127.0.0.1/24
112	score 1
113}
114```
115
116Directive name and arguments specify the actual DNS zone to query when checking
117the list. Using multiple arguments is equivalent to specifying the same
118configuration separately for each list.
119
120### client_ipv4 _boolean_
121Default: `yes`
122
123Whether to check address of the IPv4 clients against the list.
124
125---
126
127### client_ipv6 _boolean_
128Default: `yes`
129
130Whether to check address of the IPv6 clients against the list.
131
132---
133
134### ehlo _boolean_
135Default: `no`
136
137Whether to check hostname specified n the HELO/EHLO command
138against the list.
139
140This works correctly only with domain-based DNSBLs.
141
142---
143
144### mailfrom _boolean_
145Default: `no`
146
147Whether to check domain part of the MAIL FROM address against the list.
148
149This works correctly only with domain-based DNSBLs.
150
151---
152
153### responses _cidr_ | _ip..._
154Default: `127.0.0.1/24`
155
156IP networks (in CIDR notation) or addresses to permit in list lookup results.
157Addresses not matching any entry in this directives will be ignored.
158
159---
160
161### score _integer_
162Default: `1`
163
164Score value to add for the message if it is listed.
165
166If sum of list scores is equals or higher than `quarantine_threshold`, the
167message will be quarantined.
168
169If sum of list scores is equals or higher than `rejected_threshold`, the message
170will be rejected.
171
172It is possible to specify a negative value to make list act like a whitelist
173and override results of other blocklists.