Re: Help with SPAM blocking

[Michael Gale <michael.gale () bluesuperman com>]

Hello,

	Depending on your e-mail usage as a company ... you may have your DNS 
server sync with a RBL server.

RBL's work as follows:

1. A server somewhere has a list of IP addresses or ranges. This list is 
supposed to contain the IP addresses or ranges of known spammers or 
addresses that should not be sending out mail, like dial up users and 
home DSL / Broadband users.

2. You tell your mail server the name of the RBL server (example 
rbllist.mydomain.com).

3. A remote client makes a SMTP connection to your mail server, before 
your mail server responds to the "RCPT to" header it makes like a DNS 
request to the RBL server asking if it knows the clients IP address.

	If the RBL server responds with a yes, then the e-mail is rejected. If 
the response is no, then then RBL check passes.

This is a simplified version.

Michael.




Dan Lynch wrote:
> Greetings list,
>  
> I'm new to SPAM blocking and am trying to ramp up my knowledge of its
> mechanisms. I've done several days of research all over the net and
> there are still some points of confusion I can't seem to find
> explanations for. Anything you can help clarify for me is most
> appreciated. I also welcome reference to more focused mail lists I can
> query.
>  
> First, I'm still looking for a good technical explanation of how
> Realtime Blackhole Lists (RBLs) work. Many references have specific
> implementation details (the syntax of the sendmail config lines, etc),
> but not the overview of RBL technology. The overviews I have found are
> too generic and mail-recipient/end-user oriented to be of much use. 
>
> Do RBL's have a standard file format? What's it look like?
>
> What I can glean from FAQs and documentation implies there are two
> types: SMTP based and DNS based. Is this correct? Or is DNSRBL
> synonymous with RBL? Some lists (like njabl.org) imply they can be used
> by a DNS server, but I'm not clear how that functions. Why do so many
> references mention loopback addresses (see www.njabl.org/use.html, or
> the declude.com database). What's the connection?
>  
> Is it best practice to use one list integrated with your DNS server, or
> saved as a hosts file on your mail server, and another configured at
> your SMTP gateway?
>  
> Also, is an RBL downloaded to your SMTP host, or is it used as a remote
> query? If it's remote, how can one create exceptions when needed? Is
> that where your SMTP gateway's white-list feature comes in?
>
> Again, thanks for any info you can provide.
>
> Dan Lynch, CISSP
> County of Placer
> Auburn, CA
>
> dlynch at placer dot ca dot gov