Realtime Block List (RBL) - qmail-dnsbl

October 4, 2025 by Roberto Puzzanghera 32 comments

Oct 3, 2025:
- Added a Data Query Service section, which solves the ban issue from spamhaus from public DNS connections.

A Realtime Block List (RBL) is a list of addresses that an RBL list supplier believes are a source of Spam.

Download qmail-dnsbl patch
Code and logic from rblsmtpd and qmail-dnsbl patch by Fabio Busatto
Added support for welcomelists, TXT and A queries, configurable return codes 451 or 553 with custom messages (by Luca Franceschini)

This patch replaces the djb's rblsmtpd program. It incorporates into qmail-smtpd the RBL stuff with the advantage that you can see the envelope in the logs. Registering the envelope as well as the sender ip is important to always know what happened to not received messages.

An additional improvement with respect to the use of the RBL filter *before* qmail-smtpd as rblsmtpd did is that the authenticated users who want to send messages from a remote dynamic IP will not be banned; this means that we are able to switch on the filter on the 587 submission port as well :)

To activate the RBL check just add your favourite block lists in the dnsbllist control file (one per line).

cat > /var/qmail/control/dnsbllist << __EOF__
-b.barracudacentral.org
-zen.spamhaus.org
-psbl.surriel.com 
-bl.spamcop.net
__EOF__

Now restart qmail and check that the RBL lists have been parsed:

> qmailctl restart
> qmail-showctl |grep dnsbl
dnsbllist:
List at -zen.spamhaus.org configured for dnsbl check. 
List at -b.barracudacentral.org configured for dnsbl check. 
List at -psbl.surriel.com configured for dnsbl check. 
List at -bl.spamcop.net configured for dnsbl check.

Improvements with respect to the original `qmail-dnsbl` patch

default file control/dnsbllist can be overridden with env variable DNSBLLIST
if DNSBLSKIP env variable is set, qmail-smtpd skips the rbl check
if control/dnsblfailclosed or DNSBLFAILCLOSED are defined, qmail-smtpd considers the source ip as blocked even in case of lookup failures (check rblsmtpd man page for more details)
support for environment variable RBLSMTPD (check rblsmtpd man page for more details)
dnsbllist can contain empty lines and comments with '#' at start or end of lines; leading and trailing spaces are automatically removed

Examples and formats

Query rbl for TXT records, return code 451: "451 http://www.spamhaus.org/query/bl?ip=30.50.20.3"

zen.spamhaus.org

Query rbl for TXT records, return code 553: "553 http://www.spamhaus.org/query/bl?ip=30.50.20.3"

-zen.spamhaus.org

Query rbl for A records, custom return message with ret code 451: "451 Message rejected"

zen.spamhaus.org:Message rejected

Query rbl for A records, custom return message with ret code 553: "553 Message rejected", the following syntaxes are allowed:

-zen.spamhaus.org:Message rejected
zen.spamhaus.org:-Message rejected
-zen.spamhaus.org:-Message rejected

Query rbl for A records, custom return message with IP variable, replaced by remote ip:

zen.spamhaus.org:Message blocked from %IP%

dns welcomelist A query:

+welcome.dnsbl.local:welcomelist test
+welcome.dnsbl.local

The following syntaxes are NOT ALLOWED:

zen.spamhaus.org:
zen.spamhaus.org:-

Howto avoid being "cut off" by spamhaus.org

At the end of this guide I will show how to set up fail2ban in order to ban malicious IPs and then decrease the amount of connections to the RBL lists, avoiding to be banned consequently.

As an alternative, you may be interested to take a look to the idea of Costel Balta, which is addressed to solve the same problem.

One thing to pay close attention to when configuring the servers is avoiding to use public dns like google's 8.8.8.8 to resolve their services (more info here). This will cause a cut off due to the fact that they cannot measure our load of traffic on their servers if you use a public dns.

Data Query Service (DQS)

Public Mirrors to DQS Migration

Using an open DNS resolver like google's 8.8.8.8 makes Spamhaus block our queries. In the SpamAssassin's headear we'll have:

0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
dbl.spamhaus.org was blocked due to usage of an open resolver.

The Data Query Service (DQS) allows to send authenticated queries by means of a DQS Key. It's free for servers with low traffic and it offers a trial period of 30 days.

Subscribe your account here, then navigate to the page Products->Data Query Service and create your DQS Key:

Supposing that your key is xxxxxxxxxxxxxxxxxxxxxxx, change the setting in control/dnsbllist in this way

-xxxxxxxxxxxxxxxxxxxxxxx.zen.dq.spamhaus.net

Be aware that the tld domain is now .net (it was .org for the free service).

Installing the plugin for `SpamaAssassin`

Plugin for SpamAssassin

First of all let's disable the ordinary queries adding the following to /etc/mail/spamassassin/local.cf:

# disable Spamhaus 
score URIBL_DBL_SPAM 0 
score URIBL_DBL_PHISH 0 
score URIBL_DBL_MALWARE 0 
score URIBL_DBL_ABUSE 0 
score URIBL_DBL_ABUSE_REDIR 0 
score URIBL_DBL_ABUSE_PHISH 0 
score URIBL_DBL_ABUSE_MALWARE 0 
score URIBL_DBL_BLOCKED 0 
score URIBL_DBL_BLOCKED_OPENDNS 0
# disable DNSWL 
score RCVD_IN_DNSWL_BLOCKED 0 
score RCVD_IN_DNSWL_MED 0 
score RCVD_IN_DNSWL_HI 0 
score RCVD_IN_DNSWL_LOW 0

Download the latest package:

git clone https://github.com/spamhaus/spamassassin-dqs

Things go in a slightly different way when the HBL dataset is enabled (it's not enabled for free accounts).

Enter the 4.0.0+ folder and run the test to confirm that our key is valid also for HBL (this doesn't mean that it's enabled as well):

sh hbltest.sh
	Please input your DQS key: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
	Looking up test record for HBL... done
	Your DQS key xxxxxxxxxxxxxxxxxxxxxxxxxxxx is enabled for HBL
	You can copy sh_hbl.cf and sh_hbl_scores.cf if you want HBL enabled

Now you have to insert the content of the key in a couple of config files (replace xxxxxxxxxxxxxxxxxxxxxxxxx with the content of the key):

sed -i -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxxxxx/g' sh.cf
sed -i -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxxxxx/g' sh_hbl.cf

For FreeBSD users the commands are the following:

sed -i "" -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxx/g' sh.cf
sed -i "" -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxx/g' sh_hbl.cf

If HBL is not enabled, you can just copy the two following files in the SpamAssassin's configuration directory:

cp sh.cf sh_scores.cf /etc/mail/spamassassin

Now proceed below in the test sction.

If HBL is enabled, edit the file sh.pre in the first line:

loadplugin       Mail::SpamAssassin::Plugin::SH <config_directory>/SH.pm

Now replace <config_directory> with the config dir, which is /etc/mail/spamassassin. Therefore the line becomes:

loadplugin       Mail::SpamAssassin::Plugin::SH /etc/mail/spamassassin/SH.pm

If HBL is enabled, assuming that the config dir is sia /etc/mail/spamassassin, copy there the config files:

cp SH.pm sh.cf sh_scores.cf sh_hbl.cf sh_hbl_scores.cf sh.pre /etc/mail/spamassassin

Now enable HBL by editing the file /etc/mail/spamassassin/v342.pre. You have to find the line:

loadplugin Mail::SpamAssassin::Plugin::HashBL

and eventually remove the initial #.

Restart SpamAssassin:

spamdctl restart

Test the setup in this way:

spamassassin --lint

if you don't get any output then the test went well.

Testing the filter

Navigate to https://blt.spamhaus.com/ and insert a valid email address. Then add the DQS key and run the tests:

You'll get something like this:

In the above example HBL is disabled, while messages with DBL ande ZRD tests apparently failed. Be sure that DBL and ZRD tests have been rejected by SpamAssassin, by checking the junk folder:

Content analysis details:   (19.5 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.7 SPF_HELO_SOFTFAIL      SPF: HELO does not match SPF record (softfail)
-0.0 BAYES_20               BODY: Bayes spam probability is 5 to 20%
                            [score: 0.0573]
 0.0 DMARC_MISSING          Missing DMARC policy
 2.8 TXREP                  TXREP: Score normalizing based on sender's reputation
 8.0 SH_DBL_HEADERS         A domain found in headers (mail from, reply-to etc..)
                            is listed in DBL
                            [dbl-dqs.blt.spamhaus.net]
 8.0 SH_DBL_BODY            The domain of an email address found in body is listed in
                             DBL
                            [dbl-dqs.blt.spamhaus.net]

Content analysis details:   (12.1 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
-0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 8.0 SH_HELO_ZRD_VERY_FRESH The domain used in the HELO string is listed
                            in ZRD and the domain age is between 0 and 4
                            hours
                            [zrd-dqs.blt.spamhaus.net]
-0.0 BAYES_20               BODY: Bayes spam probability is 5 to 20%
                            [score: 0.1579]
 1.0 FORGED_SPF_HELO        No description available.
 0.4 KHOP_HELO_FCRDNS       Relay HELO differs from its IP's reverse DNS
 0.0 DMARC_MISSING          Missing DMARC policy
 2.7 TXREP                  TXREP: Score normalizing based on sender's reputation

Add-ons

Greetdelay

add a comment

Comments

Different zone name

Jae December 8, 2023 22:26 CET

Hello,

I am trying to use the DNSBL service truncate.gbudb.net. However, I've noticed that the zone name (truncate.gbudb.net) and the DNS server (blns0.gbudb.net) are different. This is causing some confusion for me on how to properly use this DNSBL. If I add"truncate.gbudb.net" into the list, I get an error "dnserr".

Any guidance or insights would be greatly appreciated.

Realtime Block List (RBL) - qmail-dnsbl

Improvements with respect to the original qmail-dnsbl patch

Examples and formats

Howto avoid being "cut off" by spamhaus.org

Data Query Service (DQS)

Installing the plugin for SpamaAssassin

Testing the filter

Comments

qmail notes

LXC scripts

Other contents

Recent comments

See also...

Recent posts

Improvements with respect to the original `qmail-dnsbl` patch

Installing the plugin for `SpamaAssassin`