plugin-check-dnsbl.so

A mailfront plugin to provide DNSBL/DNSWL checking of sender's IP address and
to defer, reject or accept mails based on its check.  This plugin will add
its checking results to each mail message header for all mails accepted
depending on environment variables configurations.

(1).  If $DNSBL_CHECK_SKIP is set, this plugin will be skipped.

(2).  If $RELAYCLIENT is set, add to message header and skip the remaining
      checks.  Example of message header added:

      X-DNSBL-Check-Result: SKIPPED: $RELAYCLIENT is set for 1.2.3.4

(3).  If sender is authenticated, add to message header and skip the
      remaining checks.  Example of message header added:

      X-DNSBL-Check-Result: SKIPPED: authenticated user from 1.2.3.4

(4).  If $PROTO is TCP6 or ${PROTO}REMOTEIP contain ":" character, add to
      message header and skip the remaining checks. Example of message
      header added:

      X-DNSBL-Check-Result: SKIPPED: $PROTO is TCP6 or is non-IPv4 for ${PROTO}REMOTEIP

      ${PROTO}REMOTEIP will be parsed.

(5).  If $RBLSMTPD is set and empty, add to message header and skip the
      remaining checks.  If $RBLSMTPD is set and not empty, the reply code
      is set to 553 if the first character of $RBLSMTPD is "-" otherwise
      the reply code is set to 451.  The reply message will be copied from
      $RBLSMTPD and will skip "-" if it is the starting character of
      $RBLSMTPD.  Examples of smtp.rules for tcprules:

      1.1.1.1:allow,RBLSMTPD=""
      2.2.2.2:allow,RBLSMTPD="-Your IP is listed in our denied list."
      3.3.3.3:allow,RBLSMTPD="Your IP is listed in our denied list."

      The above will cause this plugin to accept mails from IP 1.1.1.1,
      reject mails from IP 2.2.2.2 and defer mails from IP 3.3.3.3.  Below
      are the reply to sender's IP 2.2.2.2 and 3.3.3.3 respectively:

      553 Your IP is listed in our denied list.
      451 Your IP is listed in our denied list.

      Example of message header added for IP 1.1.1.1:

      X-DNSBL-Check-Result: SKIPPED: $RBLSMTPD is set and empty for 1.1.1.1

(6).  $RWLDOMAINS is the list of servers/domains to check for whitelisting
      (DNSWL).  If $RWLDOMAINS is set and not empty, the domains listed
      will be used for DNSWL checking.  Each domain needs to be seperated
      with a SPACE or a colon ":".

(7).  $RWLDOMAINSFILE is a file with list of servers/domains to check for
      whitelisting (DNSWL).   This will only be used if $RWLDOMAINS is not
      set.  i.e. copy the content into $RWLDOMAINS.
      If $RWLDOMAINSFILE not set will default to
      /var/qmail/control/rwldomains which is a define constant of
      DNSBL_RWLDOMAINS_FILE.  Format in this file is one domain per line.
      Lines started with # are ignored.

(8).  $RBLDOMAINS is the list of servers/domains to check for blacklisting
      (DNSBL).  If $RBLDOMAINS is set and not empty, the domains listed
      will be used for DNSBL checking.  Each domain needs to be seperated
      with a SPACE or a colon ":".

(9).  $RBLDOMAINSFILE is a file with list of servers/domains to check for
      blacklisting (DNSBL).   This will only be used if $RBLDOMAINS is not
      set.  i.e. copy the content into $RBLDOMAINS.
      If $RBLDOMAINSFILE not set will default to
      /var/qmail/control/rbldomains which is a define constant of
      DNSBL_RBLDOMAINS_FILE.  Format in this file is one domain per line.
      Lines started with # are ignored.

(10). If $RWLDOMAINS and $RBLDOMAINS not set or empty, add to mail
      message header and skip the DNSWL/DNSBL checks.  Example of mail
      header added:

      X-DNSBL-Check-Result: SKIPPED: $RWLDOMAINS and $RBLDOMAINS not set or empty for 1.2.3.4

(11). If $DNSBL_CHECK_REJECT is set, sender will be rejected with reply
      code 553 if sender's IP is listed in one of the $RBLDOMAINS domain.
      If sender's IP is listed in one of the $RWLDOMAINS domains, mail
      message will be accepted as this plugin take preference of
      $RWLDOMAINS domains then $RBLDOMAINS domains.

(12). If $DNSBL_CHECK_DEFER is set, sender will be rejected with reply
      code 451 if sender's IP is listed in one of the $RBLDOMAINS domain.
      If sender's IP is listed in one of the $RWLDOMAINS domains, mail
      message will be accepted as this plugin take preference of
      $RWLDOMAINS domains then $RBLDOMAINS domains.
      NOTE: $DNSBL_CHECK_REJECT take preference of $DNSBL_CHECK_DEFER.

NOTE: For (11) and (12), mails that are rejected/deferred due to blacklist,
      this plugin will use the first listed domain's TXT record in its
      reply message.  If there isn't such will default to the following:

      Sorry, your ip ${PROTO}REMOTEIP is listed in one or more of the DNSBL: $RBLDOMAINS

      The ${PROTO}REMOTEIP and $RBLDOMAINS will be parsed accordingly.

      If sender's IP is listed in one of the $RWLDOMAINS domain, instead of
      rejecting/deferring mail, mail message will be accepted and all the
      DNSWL/DNSBL check results will be added to each mail message header.

(13). If $DNSBL_CHECK_REJECT and $DNSBL_CHECK_DEFER not set, all mail
      message will be accepted with DNSWL/DNSBL check results added to each
      mail message header.

(14). If $DNSBL_CHECK_VERBOSE is set, this plugin will log its checking to
      stderr.


Requirements:

- mailfront version 2.00 or later (might work with earlier version)
- bglibs version 1.104 or later (might work with earlier version)
- libowfat (http://www.fefe.de/libowfat/)

Installation:

- Build and install mailfront
- Switch back to this package
- Adjust the contents of the conf-* files
- Build the sources by running "make"
- Install the plugin by running "make install"

Configuration:

Place check-dnsbl in mailfront's plugin list. Depending on your setup
- edit the smtpfront-qmail shell script and place the string "check-dnsbl"
  after "add-received"
- edit the PLUGINS environment variable and place the string "check-dnsbl"
  after "add-received"
- place the argument "rblcheck" after the "add-received" of the
  mailfront command

Set up environment as described in plugin-check-dnsbl.html.


This package is Copyright(C) 2013 Giam Teck Choon or CHOON.NET,
and may be copied according to the GNU GENERAL PUBLIC LICENSE (GPL)
Version 2 or a later version.  A copy of this license is included with
this package.  This package comes with no warranty of any kind.
