User:Vinod

RBL Details

What Is An RBL Or Blackhole List

An RBL (real-time blackhole list) is a type of DNSBL (DNS black list) where DNS queries are used to determine whether or not to accept e-mail from a specific IP address. The goal is to reject spam at the MTA (mail transit authority) level. The best place to reject spam is at the MTA level. This allows us to minimize server resources (e.g. no mail delivery, no scanning by spamassassin, etc). The RBL lists available are both many and varied, each of which focuses on specific goals in the IP addresses they contain.

Causes of IP blacklisted on RBL Your mail server may be misconfigured and actively exploited by bad guys. Software installed on your server may be exploited. Your workstation may be infected and forced to send spam without your knowledge. IP of your server may look like dynamically assigned or share the same block of IP addresses with an outright spammer. And here goes the worst: no blacklist maintainer will notify you about your mail server IP inclusion into their spam database.

Precautions: We should make sure that all devices on network are not infected. After we've determined our network is clean and that no unauthorized traffic is going out, find where IP address is blacklisted and contact them for removal. Each blacklist will have different ways of requesting an IP removal.

     Scan all computers on your network for viruses
   • See if there are any known and needed "patches" (updates and fixes) for your operating system
   • Configure routers more securely
   • Establish and enforce stronger passwords

How IP addresses removed from an RBL?

The procedure varies from list to list. Some will automatically prune out old IP addresses, while others allow you to fill out an online form. Most RBLs maintain a website with information about their list that can tell you more. Websites Ex. Mxtoolbox.com

Blacklist Checks on Nagios 1) b.barracudacentral.org 2) sbl.spamhaus.org 3) bl.spamcop.net 4) xbl.spamhaus.org 5) cbl.abuseat.org 6) psbl.surriel.com 7) bl.score.senderscore.com 8) dnsbl.sorbs.net

RBL’s Works & Removal Process

1) b.barracudacentral.org

1. Barracuda blacklist is free to use but it is asked to register your IP address.
2. Removal process is very easy, you just fill up their removal request.

2)sbl.spamhaus.org

1. If your server IP is caught on the spam trap it will be listed.
2. For removal purpose the Spamhaus Blocklist Removal Center can be accessed.

3) bl.spamcop.net

1. Reputation score is generated using the reports and sources
2. In spamcop there is no manual removal process, they will automatically remove your

IP when the spam source is stopped.

4) xbl.spamhaus.org

1. It lists hijacked IP addresses of a third party exploits like HTTP,SOCKS etc.
2. XBL contain the worst host on internet
3. Spamhaus Blocklist Removal Center can be used for removal purpose and is very

easy too.

5) cbl.abuseat.org

1. IPs that shows malicious behavior are blacklisted by CBL and is maintained by

spamhaus.

1. CBL is a domain based blacklist.
2. Removal process is very simple, only a request is needed to be submitted.

6) psbl.surriel.com

1. PSBL is new to DNSBL and is IP address based.
2. Removal process is easy you just wanted to submit your IP to the removal request

form.

7) bl.score.senderscore.com

#Scoring done based on volume data, spam traps and complaint sources.
#When cause of listing is resolved IP address is automatically resolved.

8) dnsbl.sorbs.net#DNS-based Block List (DNSBL) to effectively block email from more than 12 million host servers known to disseminate spam, phishing attacks and other forms of malicious email.

1. Removal process is easy you just wanted to submit your IP to the removal request form.