|
0
|
1 <html>
|
|
|
2
|
|
|
3 <head>
|
|
|
4 <meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
|
|
|
5 <title>DNSBL Sendmail milter</title>
|
|
|
6 </head>
|
|
|
7
|
|
|
8 <p>This milter is released under the GPL license version 2 included in
|
|
|
9 the LICENSE file in the distribution, and also available at
|
|
|
10 <a href="http://www.gnu.org/licenses/gpl.html">http://www.gnu.org/licenses/gpl.html</a>
|
|
|
11
|
|
|
12 <p>Consider the case of a mail server that is acting as secondary MX
|
|
|
13 for a collection of clients, each of which has a collection of mail
|
|
|
14 domains. Each client may use their own collection of DNSBLs on their
|
|
|
15 primary mail server. We present here a mechanism whereby the backup
|
|
|
16 mail server can use the correct set of DNSBLs for each message. As a
|
|
|
17 side-effect, it gives us the ability to customize the set of DNSBLs on a
|
|
|
18 per-recipient basis, so that fred@example.com could use SPEWS and the
|
|
|
19 SBL, where all other users @example.com use only the SBL.
|
|
|
20
|
|
|
21 <p>The DNSBL milter reads a text configuration file on startup, and
|
|
|
22 whenever the config file (or any of the referenced include files) is
|
|
|
23 changed. The entire configuration file is case insensitive.
|
|
|
24
|
|
|
25 <p>If you are also using the <a
|
|
|
26 href="http://www.rhyolite.com/anti-spam/dcc/">DCC</a> milter, there are
|
|
|
27 a few considerations. You may need to whitelist senders from the DCC
|
|
|
28 bulk detector, or from the DNS based lists. Those are two very
|
|
|
29 different reasons for whitelisting. The former is done thru the DCC
|
|
|
30 whiteclnt config file, the later is done thru the DNSBL milter config
|
|
4
|
31 file. There is an option to reference the DCC whiteclnt file (via an
|
|
|
32 include_dcc line) in the DNSBL milter config. This will import the
|
|
|
33 (env_to, env_from, and substitute mail_host) entries from the DCC config
|
|
|
34 into the DNSBL config. This allows using the DCC config as the single
|
|
|
35 point for white/blacklisting.
|
|
0
|
36
|
|
|
37 <p>You may want to blacklist some specific senders or sending domains.
|
|
|
38 This could be done thru either the DCC (on a global basis, or for a
|
|
|
39 specific single recipient). We prefer to do such blacklisting via the
|
|
|
40 DNSBL milter config, since it can be done for an entire recipient mail
|
|
|
41 domain. The DCC approach has the feature that you can capture the
|
|
|
42 entire message in the DCC log files. The DNSBL milter approach has the
|
|
|
43 feature that the mail is rejected earlier (at RCPT TO time), and the
|
|
|
44 sending machine just gets a generic "550 5.7.1 no such user" message.
|
|
|
45
|
|
|
46 <p>Definitions:
|
|
|
47
|
|
|
48 <p>DNSBL - a named DNS based blocking list is defined by a dns suffix
|
|
|
49 (e.g. sbl-xbl.spamhaus.org) and a message string that is used to
|
|
|
50 generate the "550 5.7.1" smtp error return code. The names of these
|
|
|
51 DNSBLs will be used to define the DNSBL-LISTs.
|
|
|
52
|
|
|
53 <p>DNSBL-LIST - a named list of DNSBLs that will be used for specific
|
|
|
54 recipients or recipient domains.
|
|
|
55
|
|
|
56 <p>ENVELOPE-FROM-MAP - a named collection of mappings (key->value pairs)
|
|
|
57 from envelope-from values to the WHITE, BLACK, or DEFAULT keywords. The
|
|
|
58 names of these maps will be used for specific recipients or recipient
|
|
|
59 domains.
|
|
|
60
|
|
|
61 <p>The configuration file maps each recipient (or recipient domain) to
|
|
|
62 two names (a named DNSBL-LIST, and a named ENVELOPE-FROM-MAP). If the
|
|
|
63 recipient is not found in the configuration, the named DEFAULT
|
|
|
64 dnsbl-list and DEFAULT envelope-from-map will be used. When mail is
|
|
|
65 received for that recipient,
|
|
|
66
|
|
|
67 <ol>
|
|
|
68
|
|
|
69 <li>If the client has authenticated with sendmail, the mail is accepted
|
|
|
70 and the dns lists are not checked.
|
|
|
71
|
|
|
72 <li>If either one is BLACK, mail to this recipient is rejected with "no
|
|
|
73 such user", and the dns lists are not checked.
|
|
|
74
|
|
|
75 <li>If the envelope-from-map name is WHITE, mail to this recipient is
|
|
|
76 accepted and the dns lists are not checked.
|
|
|
77
|
|
|
78 <li>If the envelope-from-map exists, the map is checked for the presence
|
|
|
79 of the sender. A WHITE or BLACK answer is definitive and the dns lists
|
|
|
80 are not checked.
|
|
|
81
|
|
|
82 <li>If the dnsbl-list name is WHITE, the dns lists are not checked and
|
|
|
83 the mail is accepted. Otherwise, the dns lists are checked and the mail
|
|
|
84 is rejected if any list has an A record for the standard dns based
|
|
|
85 lookup scheme (reversed octets of the client followed by the dns
|
|
|
86 suffix).
|
|
|
87
|
|
|
88 </ol>
|
|
|
89
|
|
|
90
|
|
|
91 <p>Usage: Note that this has ONLY been tested on Linux, specifically
|
|
|
92 RedHat Linux. Your mileage will vary. In particular, this milter makes no
|
|
|
93 attempt to understand IPv6.
|
|
|
94
|
|
|
95 Fetch <a href="http://www.five-ten-sg.com/util/dnsbl.tar.gz">dnsbl.tar.gz</a>
|
|
|
96 and
|
|
|
97
|
|
|
98 <pre>
|
|
|
99 tar xfvz dnsbl.tar.gz
|
|
|
100 bash install.bash
|
|
|
101 </pre>
|
|
|
102
|
|
|
103 Read and understand the contents of that install.bash script before you
|
|
|
104 run it. It may not be suitable for your system. Modify your
|
|
|
105 sendmail.mc by removing all the "FEATURE(dnsbl" lines, add the following
|
|
|
106 line in your sendmail.mc and rebuild the .cf file
|
|
|
107
|
|
|
108 <pre>
|
|
|
109 INPUT_MAIL_FILTER(`dnsbl', `S=local:/var/run/dnsbl/dnsbl.sock, F=T, T=S:30s;R:30s;E:30s')
|
|
|
110 </pre>
|
|
|
111
|
|
|
112 Read the sample <a
|
|
|
113 href="http://www.five-ten-sg.com/dnsbl.conf">var/dnsbl/dnsbl.conf</a>
|
|
|
114 file and modify it to fit your configuration.
|
|
|
115
|
|
|
116
|
|
4
|
117 <pre>
|
|
2
|
118 $Id$
|
|
4
|
119 </pre>
|
|
0
|
120 </body>
|
|
|
121 </html>
|
