Topic: [SOLVED] DNSBLs: is an identified mail supposed to be stopped dead cold?

[Michail Pappas]

I've been reading https://wiki.contribs.org/Email whereas it is said that "...When receiving an incoming message, the server first tests for RBL and DNSBL listings, if enabled. If the sender is blacklisted, the messages are blocked outright and Spamassassin never sees it. "

If I understand correctly, that a message that is found in a DNSBL is not only tagged as such in spamassassin, taking an increased spam score. Instead, it is shot on the spot. Is that right?

If it is, can someone explain why on my 9.2-based server, after enabling DNSBL it does not happen? For example:

Code: [Select]

@40000000593a406200b71524 31686 Accepted connection 0/40 from 200.105.200.14 / static-200-105-200-14.acelerate.net
@40000000593a406200b9a17c 31686 Connection from static-200-105-200-14.acelerate.net [200.105.200.14]
@40000000593a40630f0fb874 31686 (connect) earlytalker: pass, not spontaneous
@40000000593a40630f22234c 31686 (connect) relay: skip, no match
@40000000593a406321d19d9c 31686 (connect) dnsbl: karma -1 (-1)
@40000000593a406321d2e9a4 31686 (connect) dnsbl: fail, NAUGHTY, zen.spamhaus.org
@40000000593a406321d98124 31686 220 mail.pieria.gr ESMTP
@40000000593a406334159c4c 31686 dispatching HELO myserver
@40000000593a40633420e304 31686 (helo) helo: pass
@40000000593a406334253c4c 31686 250 myserver Hi static-200-105-200-14.acelerate.net [200.105.200.14]; I am so happy to meet you.
@40000000593a4064140fbff4 31686 dispatching AUTH LOGIN
@40000000593a406414137914 31686 (unrecognized_command) count_unrecognized_commands: 'auth', (1)
@40000000593a4064141522dc 31686 500 Unrecognized command
@40000000593a406430a1f574 31686 dispatching QUIT
@40000000593a406430a6856c 31686 221 myserver closing connection. Have a wonderful day.
@40000000593a406430a80ff4 31686 click, disconnecting
@40000000593a406500707ed4 2045 cleaning up after 31686
Connection does fail, but due to an unrecognised command?

My qpsmtpd setup:

Code: [Select]

qpsmtpd=service
    Bcc=disabled
    BccMode=cc
    BccUser=maillog
    DKIMSigning=enabled
    DMARCContactInfo=http://myserver/
    DMARCReject=enabled
    DMARCReportEmail=admin@mydomain
    DNSBL=enabled
    LogLevel=6
    MaxScannerSize=25000000
    RBLList=bl.spamcop.net,dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net,psbl.surriel.com,zen.spamhaus.org
    RHSBL=disabled
    RelayRequiresAuth=enabled
    SBLList=multi.surbl.org,black.uribl.com,rhsbl.sorbs.net
    TlsBeforeAuth=0
    UBLList=multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net
    URIBL=disabled
    access=public
    qplogsumm=enabled
    status=enabled


[mmccarn]

qpsmtpd 0.96 that came with SME Server 9.2 introduced the "naughty" plugin.

The pupose of "naughty" is to allow another plugin such as "DNSBL" to indicate that a message should be rejected, while allowing the conversation to go on long enough for the server to gather more information than the sending server's IP address.

Here is a tiny bit more information:
https://wiki.contribs.org/Qpsmtpd#.22Naughty.22_plugin

If you prefer the old behavior, where connections are rejected immediately, you'll need to customize this template fragment:
/etc/e-smith/templates/var/service/qpsmtpd/config/peers/0/22dnsbl to output 'dnsbl reject 1' instead of 'dnsbl reject naughty'.

You can learn more on your SME server using:

perldoc /usr/share/qpsmtpd/plugins/dnsbl

and

perldoc /usr/share/qpsmtpd/plugins/naughty

[Michail Pappas]

Thanks for the clarification. No, I will leave it as is, as long as these blacklisted-originating messages do not have a chance of being delivered