SpamAssassin

SpamAssassin - RBL

RBL (Realtime Blackhole List) is a list of networks that are misused by spammers to send unsolicited emails. The idea behind RBL is simple: to block traffic from spammer IP addresses and thus, to prevent the traffic from reaching a destination on the internet.

Figure. SpamAssasin RBL tab.

Field	Description
Active	Enables the use of RBL servers.
RBL server list	Check the box against each RBL server you want to use. Warning: You should limit the number of servers you choose to query for RBL processing as this can have a detrimental effect on your server performance. Each server would have to be queried at least once for each incoming message, adding overhead to the processing. If a number of DNSBL hosts exceeds the limit of 4, a warning message appears. RBL contains a list of IP addresses whose owners refuse to stop the proliferation of spam from their servers. The RBL usually lists ISPs whose customers are responsible for spam or email servers that are hijacked by spammers to send spam. Note: Extended RBL codes are supported, see http://www.us.sorbs.net/using.shtml for further information. If you use dnsbl.sorbs.net as your RBL, it will return a code that signifies which blacklist(s) contained an entry. For example: 127.0.0.3 is returned for an open SOCKS server. 127.0.0.5 is returned for an open SMTP relay server. Note: There are two dnsbl.sorbs.net items in the list (marked (A) and (B)). There are two different rules, both using dnsbl.sorbs.net - if you decide to use it, Check only one of them.

Field

Description

Active

Enables the use of RBL servers.

RBL server list

Check the box against each RBL server you want to use.

Warning: You should limit the number of servers you choose to query for RBL processing as this can have a detrimental effect on your server performance.
Each server would have to be queried at least once for each incoming message, adding overhead to the processing.

If a number of DNSBL hosts exceeds the limit of 4, a warning message appears.

RBL contains a list of IP addresses whose owners refuse to stop the proliferation of spam from their servers. The RBL usually lists ISPs whose customers are responsible for spam or email servers that are hijacked by spammers to send spam.

Note: Extended RBL codes are supported, see http://www.us.sorbs.net/using.shtml for further information.
If you use dnsbl.sorbs.net as your RBL, it will return a code that signifies which blacklist(s) contained an entry.
For example:
127.0.0.3 is returned for an open SOCKS server.
127.0.0.5 is returned for an open SMTP relay server.

Note: There are two dnsbl.sorbs.net items in the list (marked (A) and (B)).
There are two different rules, both using dnsbl.sorbs.net - if you decide to use it, Check only one of them.

Table 1. Options available inSpamAssassinRBL tab.

SORBS - More Details

Notice that if you just enable SORBS here, SpamAssassin default scores will be used. If you check the spam/rules/rbl.list file, you will see SORBS is referred to as RCVD_IN_SORBS_DUL;dnsbl.sorbs.net.

Search now inside the spam/rules/ folder for dnsbl.sorbs.net.

You will find the 20_dnsbl.tests.cf file with all the tests done on dnsbl.sorbs.net for each result code and you will find the 50_scores.cf file where you can see what score is added according to each result code.

Note: Refer to Mail Service -Reference - Rules - Content Filters for information on how to check DNSBLs and DNSWLs directly in content filters, dis-considering SpamAssassin scores etc. and thus, defining your own actions / score increase or decrease.