Internal DNS Block List - take two
Posted: Thu Sep 03, 2009 11:21 am
I really didn't like my first effort at creating a dns block list that worked with plesk, so I went back to the drawing board. This one uses perl to watch the maillog in real-ish time for IPs sending rejected and good email, storing the info in a MySQL database. It will also give a bit of slack for senders that send mail that makes it through without getting tagged by spamassassin. This is really meant to replace all the other dnsbl lists in qmail, and use spamassassin to query them (and score them into oblivion) to build up your own. Doing it this way will have the added benefit of knowing who is being blocked, since qmail doesn't log rejected connections. After a configured time entries in the dns list are removed, and all entries also gradually drift back to a "neutral" stance.
By default you get 5 rejects before blocking, up to 15 rejects for hosts that send good email (5 + 1 for each clear message up to 10), entries live in DNS for 5 days, and any host that hasn't been seen in 180 days is removed from the database. All of which are configurable. You can use the spamassassin cf example from my first attempt to see how something like this works in your environment. After less than 24 hours of testing on my host, it was the number 3 hit rule - beat out only by AWL and RELAY_COUNTRY_US. See the sa-stats.txt file in the attached archive for detail - my list is RCVD_IN_ASBL.
Thoughts and critiques are welcome.
By default you get 5 rejects before blocking, up to 15 rejects for hosts that send good email (5 + 1 for each clear message up to 10), entries live in DNS for 5 days, and any host that hasn't been seen in 180 days is removed from the database. All of which are configurable. You can use the spamassassin cf example from my first attempt to see how something like this works in your environment. After less than 24 hours of testing on my host, it was the number 3 hit rule - beat out only by AWL and RELAY_COUNTRY_US. See the sa-stats.txt file in the attached archive for detail - my list is RCVD_IN_ASBL.
Thoughts and critiques are welcome.