What is RBL?

RBL is a nice idea, us­ing DNS to tag IP­s.

For ex­am­ple, sup­pose you want to tag all the IPs that you know send spam:

10.0.0.14
172.16.2.3

You could have a DNS serv­er for the do­main "myr­bl.tld", and then re­solve for those IPs like this:

10.0.0.14.myrbl.tld -> 127.0.0.1
172.16.2.3.myrbl.tld -> 127.0.0.2

You can cod­i­fy your opin­ion of that IP in the an­swer. For in­stance, 127.0.0.1 may mean 10.0.0.14 is an open re­lay, and 127.0.0.2 may mean that 172.16.2.3 is a known spam­mer.

Or you can just say "host not found" is good, any­thing else is bad.

There are a num­ber of RBL servers out there, but I am most fa­mil­iar with spam­cop.net and njabl.org

So, when­ev­er you get a SMTP con­nec­tion, you can check the IP agains one data­base (or both­), and then you can de­cide to block (or not) the con­nec­tion based on the an­swer you get.

Neat, right?

The problems with RBL

There are many is­sues you need to keep in mind. Most of them are pol­i­cy re­lat­ed, a few are tech­ni­cal, but here are some I came up with:

• What RBL should you use?

  RBLs are not all equal. Some are more zeal­ous than oth­­er­s, some would sim­­ply make your serv­er un­us­able. Some of them, once you get in, it's al­­most im­­pos­si­ble to get out, and they list rou­tine­­ly many le­git­i­­mate server­s. I am not vouch­ing even for the ones I use!

• What is nore im­­por­­tan­t, spam or email?

  What­ev­er you use, there is bound to be some email that can not be sent to you eas­i­­ly. Some friend/­­clien­t/what­ev­er of yours is go­ing to have his SMTP serv­er list­ed and it's go­ing to be an­noy­ing.

  So, if you must ab­­so­­lute­­ly, pos­i­­tive­­ly get all your mail, RBLs are not a great idea.

• Main­te­­nance.

  You will even­­tu­al­­ly have to deal with ex­­tra sup­­port ques­­tion­s, com­­plaints, etc. about why you are "block­­ing some­one's mail" and some­­such. If you are care­­ful, that should be kept to a min­i­­mum. But nev­er to ze­ro.

• Poli­­cies.

  When do you per­­form the check? What do you do with the checks re­­sult­s? Here are some ex­am­­ples:

  1. Check on con­nec­­tion, and refuse con­nec­­tions from list­ed IP­s.
  2. Check on the MAIL com­­mand, and refuse to ac­­cept mails from list­ed IPs if the us­er is not au­then­ti­­cat­ed.
  3. Check on MAIL and add a head­­er to all mail com­ing from RBL-list­ed servers with nonau­then­ti­­cat­ed and let it pass, lat­er file it in a sep­a­rate fold­er.

You can be cre­ative here, peo­ple, as long as you read this thing all the way through :-)

Tools

Qmail comes with a RBL tool, called rblsmt­pd . Per­son­al­ly I don't like it much, and I am not go­ing to cov­er it fur­ther, but here's what I un­der­stand about how it's meant to be used:

You hook it to your qmail-smt­pd com­mand chain (be­fore qmail-smt­pd), and then if TCPRE­MOTEIP is RBL-list­ed, it hangs up the con­nec­tion.

My prob­lem with that is that if you want to use a dy­namip-ip ad­dress RBL, then al­most none of your own users will be able to use your own server!

A so­lu­tion to that is to al­so run a MSA serv­er on port 587, with­out RBL check­s, with manda­to­ry SMTP AU­TH, and tell your users to use that.

I do rec­om­mend run­ning such a MSA serv­er. How­ev­er, the sup­port load for the change to MSA is large (all com­mon MUAs come pre­con­fig­ured for port 25), and users will make mis­takes, then get a cryp­tic er­ror about how their con­nec­tion is not want­ed.

I pre­fer to use a plug­in along with Qmail-SPP.

Qmail-SPP is a qmail patch that lets you hook your own plug­ins (s­mall pro­gram­s) in­to qmail-smt­pd at ev­ery step of the pro­cess, make de­ci­sions about it, and mod­i­fy head­ers (and oth­er things, it's re­al­ly cool func­tion­al­i­ty!)

What I do is put a plug­in I wrote, called rblchecks at the be­gin­ning of the MAIL com­mand.

If the us­er is au­then­ti­cat­ed, it will do noth­ing, so it will ac­cept mail from your own user­s.

But if the us­er is not au­then­ti­cat­ed, and the source IP is RBL-list­ed, it will kick you out (ac­tu­al­ly, it on­ly gives you a mes­sage).

I wrote it us­ing the Bet­ter String Li­brary main­ly be­cause pro­gram­ming C for ar­bi­trary in­put I am a com­plete chick­en.

But first, a few con­ven­tions on how you write a qmail-spp plug­in.

1. Ev­ery­thing you print on std­out goes to qmail-sp­p, and it's com­mand­s. Like "Give this er­ror" or "Add this head­er"
2. You get your in­for­ma­tion about the mes­sage and the con­nec­tion from en­vi­ron­ment vari­ables. for ex­am­ple TCPRE­MOTEIP is the re­mote ip.
3. What you print on stderr goes to the logs. So be care­ful, and log mean­ing­ful­ly! Specif­i­cal­ly, I al­ways print the plug­in name, and the par­ent process ID, which can be used to group all mes­sages from a sin­gle con­nec­tion, thus mak­ing the log use­ful.
4. Be care­ful.
5. Be quick. What­ev­er you de­lay, there may be a guy wait­ing, look­ing at out­look while you dither.

To make my plug­in more con­fig­urable, I de­cid­ed that you could pass a colon-sep­a­rat­ed list of RBL servers to be checked in the RBLSERVERS en­vi­ron­ment vari­able.

Usu­al­ly, you would set this ei­ther on qmail's start­up scrip­t, or, if you are us­ing tcpserv­er (y­ou prob­a­bly are if you are us­ing qmail), from its tcprules con­trol file.

For ex­am­ple, this is a per­fect­ly le­gal and nice rules file:

:allow,RBLSERVERS="bl.spamcop.net:combined.njabl.org",QMAILQUEUE="/usr/bin/simscan"

Yup. One line. No re­lays (use au­then­ti­ca­tion, guys!). Two RBL list­s. Sim­scan so you get no virus­es.

Then, you con­fig­ure the rblchecks plug­in in your smtp­plu­g­ins file on the mail sec­tion.

And that's it. You should see your spam go down, and you should see your serv­er load go down. In­stant­ly.

So, you want the plug­in code? Get it then!

As a bonus, you get a whole col­lec­tion of plug­ins for dif­fer­ent pur­pos­es, but please, please, please, don't use them un­less you re­al­ly know what you are do­ing. This is pret­ty much all new code :-)

Any com­ments, bug re­port­s, hap­py sto­ries... email me! Or leave com­ments. Or both!

And here is the code for this plug­in (there may be new­er code in the lat­est plug­in):