1Mail::SpamAssassin::PluUgsienr::CUoRnItDrNiSbBuLt(e3d)PMearill:D:oScpuammeAnstsaatsisoinn::Plugin::URIDNSBL(3)
2
6 URIDNSBL - look up URLs against DNS blocklists
7
9 loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
10 uridnsbl URIBL_SBLXBL sbl-xbl.spamhaus.org. TXT
11
13 This works by analysing message text and HTML for URLs, extracting host
14 names from those, then querying various DNS blocklists for either: IP
15 addresses of these hosts (uridnsbl,a) or their nameservers
16 (uridnsbl,ns), or domain names of these hosts (urirhsbl), or domain
17 names of their nameservers (urinsrhsbl, urifullnsrhsbl).
18
20 skip_uribl_checks ( 0 | 1 ) (default: 0)
21 Turning on the skip_uribl_checks setting will disable the URIDNSBL
22 plugin.
23 By default, SpamAssassin will run URI DNSBL checks. Individual URI
25 blocklists may be disabled selectively by setting a score of a
26 corresponding rule to 0 or through the uridnsbl_skip_domain
27 parameter.
28 See also a related configuration parameter skip_rbl_checks, which
30 controls the DNSEval plugin (documented in the Conf man page).
31 uridnsbl_skip_domain domain1 domain2 ...
33 Specify a domain, or a number of domains, which should be skipped
34 for the URIBL checks. This is very useful to specify very common
35 domains which are not going to be listed in URIBLs.
36 In addition to trimmed domain, the full hostname is also checked
38 from the list.
39 clear_uridnsbl_skip_domain [domain1 domain2 ...]
41 If no argument is given, then clears the entire list of domains
42 declared by uridnsbl_skip_domain configuration directives so far.
43 Any subsequent uridnsbl_skip_domain directives will start creating
44 a new list of skip domains.
45 When given a list of domains as arguments, only the specified
47 domains are removed from the list of skipped domains.
48
50 uridnsbl NAME_OF_RULE dnsbl_zone lookuptype
51 Specify a lookup. "NAME_OF_RULE" is the name of the rule to be
52 used, "dnsbl_zone" is the zone to look up IPs in, and "lookuptype"
53 is the type of lookup (TXT or A). Note that you must also define
54 a body-eval rule calling check_uridnsbl() to use this.
55 This works by collecting domain names from URLs and querying DNS
57 blocklists with an IP address of host names found in URLs or with
58 IP addresses of their name servers, according to tflags as follows.
59 If the corresponding body rule has a tflag 'a', the DNS blocklist
61 will be queried with an IP address of a host found in URLs.
62 If the corresponding body rule has a tflag 'ns', DNS will be
64 queried for name servers (NS records) of a domain name found in
65 URLs, then these name server names will be resolved to their IP
66 addresses, which in turn will be sent to DNS blocklist.
67 Tflags directive may specify either 'a' or 'ns' or both flags. In
69 absence of any of these two flags, a default is a 'ns', which is
70 compatible with pre-3.4 versions of SpamAssassin.
71 The choice of tflags must correspond to the policy and expected use
73 of each DNS blocklist and is normally not a local decision. As an
74 example, a blocklist expecting queries resulting from an 'a' tflag
75 is a "black_a.txt" ( http://www.uribl.com/datasets.shtml ).
76 Example:
78 uridnsbl URIBL_SBLXBL sbl-xbl.spamhaus.org. TXT
80 body URIBL_SBLXBL eval:check_uridnsbl('URIBL_SBLXBL')
81 describe URIBL_SBLXBL Contains a URL listed in the SBL/XBL blocklist
82 tflags URIBL_SBLXBL net ns
83 uridnssub NAME_OF_RULE dnsbl_zone lookuptype subtest
85 Specify a DNSBL-style domain lookup with a sub-test.
86 "NAME_OF_RULE" is the name of the rule to be used, "dnsbl_zone" is
87 the zone to look up IPs in, and "lookuptype" is the type of lookup
88 (TXT or A).
89 Tflags 'ns' and 'a' on a corresponding body rule are recognized and
91 have the same meaning as in the uridnsbl directive.
92 "subtest" is a sub-test to run against the returned data. The sub-
94 test may be in one of the following forms: m, n1-n2, or n/m, where
95 n,n1,n2,m can be any of: decimal digits, 0x followed by up to 8
96 hexadecimal digits, or an IPv4 address in quad-dot form. The 'A'
97 records (IPv4 dotted address) as returned by DNSBLs lookups are
98 converted into a numerical form (r) and checked against the
99 specified sub-test as follows: for a range n1-n2 the following must
100 be true: (r >= n1 && r <= n2); for a n/m form the following must be
101 true: (r & m) == (n & m); for a single value in quad-dot form the
102 following must be true: r == n; for a single decimal or hex form
103 the following must be true:
104 ((r & n) != 0) && ((r & 0xff000000) == 0x7f000000), i.e. within
105 127.0.0.0/8
106 Some typical examples of a sub-test are: 127.0.1.2,
108 127.0.1.20-127.0.1.39, 127.0.1.0/255.255.255.0, 0.0.0.16/0.0.0.16,
109 0x10/0x10, 16, 0x10 .
110 Note that, as with "uridnsbl", you must also define a body-eval
112 rule calling check_uridnsbl() to use this.
113 Example:
115 uridnssub URIBL_DNSBL_4 dnsbl.example.org. A 127.0.0.4
117 uridnssub URIBL_DNSBL_8 dnsbl.example.org. A 8
118 urirhsbl NAME_OF_RULE rhsbl_zone lookuptype
120 Specify a RHSBL-style domain lookup. "NAME_OF_RULE" is the name of
121 the rule to be used, "rhsbl_zone" is the zone to look up domain
122 names in, and "lookuptype" is the type of lookup (TXT or A). Note
123 that you must also define a body-eval rule calling check_uridnsbl()
124 to use this.
125 An RHSBL zone is one where the domain name is looked up, as a
127 string; e.g. a URI using the domain "foo.com" will cause a lookup
128 of "foo.com.uriblzone.net". Note that hostnames are trimmed to the
129 domain portion in the URIBL lookup, so the domain "foo.bar.com"
130 will look up "bar.com.uriblzone.net", and "foo.bar.co.uk" will look
131 up "bar.co.uk.uriblzone.net". Using tflag "notrim" will force full
132 hostname lookup, but the specific uribl must support this method.
133 If an URI consists of an IP address instead of a hostname, the IP
135 address is looked up (using the standard reversed quads method) in
136 each "rhsbl_zone".
137 Example:
139 urirhsbl URIBL_RHSBL rhsbl.example.org. TXT
141 urirhssub NAME_OF_RULE rhsbl_zone lookuptype subtest
143 Specify a RHSBL-style domain lookup with a sub-test.
144 "NAME_OF_RULE" is the name of the rule to be used, "rhsbl_zone" is
145 the zone to look up domain names in, and "lookuptype" is the type
146 of lookup (TXT or A).
147 "subtest" is a sub-test to run against the returned data. The sub-
149 test may be in one of the following forms: m, n1-n2, or n/m, where
150 n,n1,n2,m can be any of: decimal digits, 0x followed by up to 8
151 hexadecimal digits, or an IPv4 address in quad-dot form. The 'A'
152 records (IPv4 dotted address) as returned by DNSBLs lookups are
153 converted into a numerical form (r) and checked against the
154 specified sub-test as follows: for a range n1-n2 the following must
155 be true: (r >= n1 && r <= n2); for a n/m form the following must be
156 true: (r & m) == (n & m); for a single value in quad-dot form the
157 following must be true: r == n; for a single decimal or hex form
158 the following must be true:
159 ((r & n) != 0) && ((r & 0xff000000) == 0x7f000000), i.e. within
160 127.0.0.0/8
161 Some typical examples of a sub-test are: 127.0.1.2,
163 127.0.1.20-127.0.1.39, 127.2.3.0/255.255.255.0, 0.0.0.16/0.0.0.16,
164 0x10/0x10, 16, 0x10 .
165 Note that, as with "urirhsbl", you must also define a body-eval
167 rule calling check_uridnsbl() to use this. Hostname to domain
168 trimming is also done similarly.
169 Example:
171 urirhssub URIBL_RHSBL_4 rhsbl.example.org. A 127.0.0.4
173 urirhssub URIBL_RHSBL_8 rhsbl.example.org. A 8
174 urinsrhsbl NAME_OF_RULE rhsbl_zone lookuptype
176 Perform a RHSBL-style domain lookup against the contents of the NS
177 records for each URI. In other words, a URI using the domain
178 "foo.com" will cause an NS lookup to take place; assuming that
179 domain has an NS of "ns0.bar.com", that will cause a lookup of
180 "bar.com.uriblzone.net". Note that hostnames are stripped from
181 both the domain used in the URI, and the domain in the lookup.
182 "NAME_OF_RULE" is the name of the rule to be used, "rhsbl_zone" is
184 the zone to look up domain names in, and "lookuptype" is the type
185 of lookup (TXT or A).
186 Note that, as with "urirhsbl", you must also define a body-eval
188 rule calling check_uridnsbl() to use this.
189 urinsrhssub NAME_OF_RULE rhsbl_zone lookuptype subtest
191 Specify a RHSBL-style domain-NS lookup, as above, with a sub-test.
192 "NAME_OF_RULE" is the name of the rule to be used, "rhsbl_zone" is
193 the zone to look up domain names in, and "lookuptype" is the type
194 of lookup (TXT or A). "subtest" is the sub-test to run against the
195 returned data; see <urirhssub>.
196 Note that, as with "urirhsbl", you must also define a body-eval
198 rule calling check_uridnsbl() to use this.
199 urifullnsrhsbl NAME_OF_RULE rhsbl_zone lookuptype
201 Perform a RHSBL-style domain lookup against the contents of the NS
202 records for each URI. In other words, a URI using the domain
203 "foo.com" will cause an NS lookup to take place; assuming that
204 domain has an NS of "ns0.bar.com", that will cause a lookup of
205 "ns0.bar.com.uriblzone.net".
206 "NAME_OF_RULE" is the name of the rule to be used, "rhsbl_zone" is
208 the zone to look up domain names in, and "lookuptype" is the type
209 of lookup (TXT or A).
210 Note that, as with "urirhsbl", you must also define a body-eval
212 rule calling check_uridnsbl() to use this.
213 urifullnsrhssub NAME_OF_RULE rhsbl_zone lookuptype subtest
215 Specify a RHSBL-style domain-NS lookup, as above, with a sub-test.
216 "NAME_OF_RULE" is the name of the rule to be used, "rhsbl_zone" is
217 the zone to look up domain names in, and "lookuptype" is the type
218 of lookup (TXT or A). "subtest" is the sub-test to run against the
219 returned data; see <urirhssub>.
220 Note that, as with "urirhsbl", you must also define a body-eval
222 rule calling check_uridnsbl() to use this.
223 tflags NAME_OF_RULE ips_only
225 Only URIs containing IP addresses as the "host" component will be
226 matched against the named "urirhsbl"/"urirhssub" rule.
227 tflags NAME_OF_RULE domains_only
229 Only URIs containing a non-IP-address "host" component will be
230 matched against the named "urirhsbl"/"urirhssub" rule.
231 tflags NAME_OF_RULE ns
233 The 'ns' flag may be applied to rules corresponding to uridnsbl and
234 uridnssub directives. Host names from URLs will be mapped to their
235 name server IP addresses (a NS lookup followed by an A lookup),
236 which in turn will be sent to blocklists. This is a default when
237 neither 'a' nor 'ns' flags are specified.
238 tflags NAME_OF_RULE a
240 The 'a' flag may be applied to rules corresponding to uridnsbl and
241 uridnssub directives. Host names from URLs will be mapped to their
242 IP addresses, which will be sent to blocklists. When both 'ns' and
243 'a' flags are specified, both queries will be performed.
244 tflags NAME_OF_RULE notrim
246 The full hostname component will be matched against the named
247 "urirhsbl"/"urirhssub" rule, instead of using the trimmed domain.
248 This works better, but the specific uribl must support this method.
249
251 uridnsbl_max_domains N (default: 20)
252 The maximum number of domains to look up.
253 parse_dkim_uris ( 0 / 1 )
255 Include DKIM uris in lookups. This option is documented in
256 Mail::SpamAssassin::Conf.
257
259 The "uridnsbl_timeout" option has been obsoleted by the "rbl_timeout"
260 option. See the "Mail::SpamAssassin::Conf" POD for details on
261 "rbl_timeout".
262perl v5.36.0 2023-0M1a-i2l1::SpamAssassin::Plugin::URIDNSBL(3)