Spamhaus Blacklist

[basti]

Hello,
Iuse the spamhaus blacklist for exim (CHECK_RCPT_IP_DNSBLS).

First of all what are the differences between CHECK_RCPT_IP_DNSBLS and
CHECK_RCPT_DOMAIN_DNSBLS ??

Make it sense to use both? if yes can I also use zen.spamhaus.org for this?

Is there also a way to report spam servers to spamhaus?
Actually I get some spam from "84.19.164.45"but this ip is not blocked
at the moment.

Regards,
Basti

[Jeremy Harris]

Post by basti
Iuse the spamhaus blacklist for exim (CHECK_RCPT_IP_DNSBLS).
First of all what are the differences between CHECK_RCPT_IP_DNSBLS and
CHECK_RCPT_DOMAIN_DNSBLS ??

Exim does not define these. Presumably they are macros defined
by some part of the configuration provided by your OS distribution;
you will need to ask in a more specific forum.
--
Cheers,
Jeremy

[Graeme Fowler]

Post by basti
Iuse the spamhaus blacklist for exim (CHECK_RCPT_IP_DNSBLS).
First of all what are the differences between CHECK_RCPT_IP_DNSBLS and
CHECK_RCPT_DOMAIN_DNSBLS ??

These look like distribution-specific macros; they are not defined in
the default configuration file.

Regarding Spamhaus themselves, you'll find details of their services
here:

http://www.spamhaus.org/

They do not take submissions from arbitrary third parties.

Graeme

[Jasen Betts]

Post by basti
Hello,
Iuse the spamhaus blacklist for exim (CHECK_RCPT_IP_DNSBLS).
First of all what are the differences between CHECK_RCPT_IP_DNSBLS and
CHECK_RCPT_DOMAIN_DNSBLS ??

looks debian specific, one is for looking up IP addresses the other
is for looking up domain names. I'm not sure which doman names,
perhaps the HELO name?

Post by basti
Make it sense to use both? if yes can I also use zen.spamhaus.org for this?

I think spamhaus is an IP blacklist only.

Post by basti
Is there also a way to report spam servers to spamhaus?

I don't think so. AIUI it's all driven by spamtraps.

[Mike Cardwell]

Post by Jasen Betts
I think spamhaus is an IP blacklist only.

They also have a domain based blacklist these days:

http://www.spamhaus.org/dbl/
http://www.spamhaus.org/faq/section/Spamhaus%20DBL

***@glue:~$ dig +short a dbltest.com.dbl.spamhaus.org
127.0.1.2
***@glue:~$ dig +short txt dbltest.com.dbl.spamhaus.org
"http://www.spamhaus.org/query/dbl?domain=dbltest.com"
***@glue:~$

[Phil Pennock]

Post by basti
Iuse the spamhaus blacklist for exim (CHECK_RCPT_IP_DNSBLS).
First of all what are the differences between CHECK_RCPT_IP_DNSBLS and
CHECK_RCPT_DOMAIN_DNSBLS ??

That's Debian; the man-pages are lacking, but the comments in the input
files for Debian's configuration system are illuminating.

$ less /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
----------------------------8< cut here >8------------------------------
# Check against classic DNS "black" lists (DNSBLs) which list
# sender IP addresses
.ifdef CHECK_RCPT_IP_DNSBLS
warn
dnslists = CHECK_RCPT_IP_DNSBLS
add_header = X-Warning: $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
log_message = $sender_host_address is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
.endif


# Check against DNSBLs which list sender domains, with an option to locally
# whitelist certain domains that might be blacklisted.
#
# Note: If you define CHECK_RCPT_DOMAIN_DNSBLS, you must append
# "/$sender_address_domain" after each domain. For example:
# CHECK_RCPT_DOMAIN_DNSBLS = rhsbl.foo.org/$sender_address_domain \
# : rhsbl.bar.org/$sender_address_domain
.ifdef CHECK_RCPT_DOMAIN_DNSBLS
warn
!senders = ${if exists{CONFDIR/local_domain_dnsbl_whitelist}\
{CONFDIR/local_domain_dnsbl_whitelist}\
{}}
dnslists = CHECK_RCPT_DOMAIN_DNSBLS
add_header = X-Warning: $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
log_message = $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
.endif
----------------------------8< cut here >8------------------------------

So, if you don't follow the instructions (which require knowing both
Exim and Debian's config system to find) then the only difference is
that `CHECK_RCPT_DOMAIN_DNSBLS` is not checked if the sender address is
listed in a pattern from `/etc/exim4/local_domain_dnsbl_whitelist`.

If you follow the hints, which involves _you_ supplying the
`/$sender_address_domain` on each entry, then they serve different
purposes and your log messages will make more sense. :)