VBS: мониторинг попаданий в DNSBL
Ситуация — есть у нас один большой клиент. Можно сказать ключевой. И есть у него неприятная черта — его почтовый сервер на DNSBL прямо-таки молится.
В общем стоит попасть в блэклист баракуды и начинается коллапс с недоходящей до них почтой(ибо баллами они не пользуются, а блокируют безоговорочно). Т.к. в нескольких случаях ситуация возникала в пятницу под вечер, то наши сотрудники следуя традиции («само исправится» — ведь даже менеджеры, свободно общающиеся на английском с клиентами, оказываются неспособны прочитать банальное уведомление о блокировке) сообщали о проблеме только в понедельник. А т.к. удаление из списка процесс не быстрый, то пол дня без возможности связаться с клиентом. Момент крайне неприятный.
Собственно для того чтобы оперативно отслеживать данную ситуацию и решил написать скриптик(в бою пока не был, но на IP из серверных логов потестировал). Надеюсь будет полезен не только мне.
' VB Script Document Option Explicit ' http://www.barracudacentral.org/rbl/how-to-use ' http://ru.wikipedia.org/wiki/DNSBL ' если IP есть в блоклисте, то будет резолвиться хостнейм вида IP_наоборот.black.list.hostname ' например, для 192.149.23.63 на баракуде нужно проверять 63.23.149.192.b.barracudacentral.org ' резолвиться будет в адрес 127.0.0.x (обычно, но не обязательно) ' X - в зависимости от причины попадания в список(хотя официального документа на этот счёт видимо нет) ' http://www.spamhaus.org/faq/answers.lasso?section=DNSBL%20Usage#202 - расшифровка X для SPAMHOUSE Dim RegPath, Write2Reg RegPath = "HKLM\Software\VBS Scripts Settings\DNSBL_Monitoring" ' Храним тут Write2Reg = true ' false - отключает запись в реестр(а вдруг будет нужно?) ' Параметры отправки почты Dim smtp_host, smtp_auth, smtp_port, smtp_user, smtp_pass, from_email, to_email smtp_host = "mail.mydomen.com" smtp_auth = 0 ' если 1(т.е. с авторизацией), то пароль нужен обязательно smtp_port = 25 smtp_user = "myusername" smtp_pass = "mypassword" from_email = "dnsbl.monitoring@ru.mydomen.com" to_email = "my.name@ru.mydomen.com" Dim DNSBL, Hosts, TestHost TestHost = "8.8.8.8" ' "неумерающий" хост для проверки доступности интернета, например публичный ДНС гугла Set DNSBL = CreateObject("Scripting.Dictionary") 'список блэклистов DNSBL.Add "b.barracudacentral.org", "Вражина №1" DNSBL.Add "sbl.spamhaus.org", "SBL Spamhaus" DNSBL.Add "xbl.spamhaus.org", "XBL Spamhaus" DNSBL.Add "pbl.spamhaus.org", "PBL Spamhaus" 'DNSBL.Add "zen.spamhaus.org", "ZEN Spamhaus" ' OFF потому что объединяет ответ не только с SBL, XBL, PBL, но и с cbl.abuseat.org ' к тому-же если IP числится только в cbl.abuseat.org(а не в SBL, XBL or PBL), ' то сайт выдаёт "LISTED", а по лукапу выходит NOTLISTED ' подробности - http://www.spamhaus.org/faq/answers.lasso?section=DNSBL%20Usage#252 DNSBL.Add "cbl.abuseat.org", "cbl.abuseat.org" DNSBL.Add "bl.spamcop.net", "bl.spamcop.net" DNSBL.Add "dnsbl.sorbs.net", "dnsbl.sorbs.net" DNSBL.Add "web.dnsbl.sorbs.net", "web.dnsbl.sorbs.net" DNSBL.Add "bl.tiopan.com", "bl.tiopan.com" Set Hosts = CreateObject("Scripting.Dictionary") 'список проверяемых IP-адресов Hosts.Add "94.100.177.6", "pop3.mail.ru" Hosts.Add "74.125.39.109", "pop.gmail.com" Hosts.Add "87.250.250.124", "imap.yandex.ru" Hosts.Add "86.35.249.224", "Blocked IP2" Hosts.Add "194.250.63.103", "Blocked IP" '############################################################################## '###### все настройки выше ###### '############################################################################## Dim TotalTimer TotalTimer = Timer ' объекты: Dim WshShell Set WshShell = WScript.CreateObject("WScript.Shell") Dim Key ' для возврата значений ключа реестра Dim arrDNSBL, arrHosts arrDNSBL = DNSBL.Keys arrHosts = Hosts.Keys Dim BBody, Need2Report BBody = " DNSBL_Monitoring
начало работы скрипта: " & Now & "
" ' "начинаем" тело Need2Report = false ' если появятся новые данные по блокировкам, станет true Dim i, j For i = LBound(arrDNSBL) To UBound(arrDNSBL) 'пинганём список. DNSBL.Item(arrDNSBL(i)) = vbNullstring ' очистка перед заполнением For j = LBound(arrHosts) To UBound(arrHosts) 'пинганём список. 'читаем соотв. ключ в реестре и проверяем что IP ещё не там ' ############################################################################## if Ping(TestHost) then ' инет есть, можно проверять BL Key = DoTheKey(RegPath, arrDNSBL(i), false, vbNullstring) 'wscript.echo "Key = " & Key ' 0 then ' если ключ непустой - проверяем есть ли в нём IP, иначе переход на проверку хоста if InStr(1, Key, arrHosts(j), vbTextCompare) > 0 then 'если IP уже блокировался if not IsInBL(arrDNSBL(i), arrHosts(j)) then ' если более не в списке - уведомляем что IP удалён из BL BBody = BBody & "IP-адрес " & arrHosts(j) & "(" & Hosts.Item(arrHosts(j)) & ") был удалён из DNSBL: " & arrDNSBL(i) & "
" Need2Report = true end if else '> ранее IP в BL не числился if IsInBL(arrDNSBL(i), arrHosts(j)) then ' попал в список - уведомляем BBody = BBody & "IP-адрес " & arrHosts(j) & "(" & Hosts.Item(arrHosts(j)) & ") был занесён в DNSBL: " & arrDNSBL(i) & "
" Need2Report = true end if end if ' IP в списке? else ' если Key пустой => блоклист ранее не проверялся if IsInBL(arrDNSBL(i), arrHosts(j)) then ' попал в список - уведомляем BBody = BBody & "IP-адрес " & arrHosts(j) & "(" & Hosts.Item(arrHosts(j)) & ") был занесён в DNSBL: " & arrDNSBL(i) & "
" Need2Report = true end if end if ' >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> else ' или инета нет, или гугл накрылся :) '>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> end if ' жив ли гугл? Next 'j Key = DoTheKey(RegPath, arrDNSBL(i), true, DNSBL.Item(arrDNSBL(i))) Next 'i BBody = BBody & "
" & Now & " => Проверка завершена. Продолжительность проверки: " & Timer - TotalTimer & " сек." BBody = BBody & "" if Need2Report then call SendMail("DNSBL Monitoring Report", BBody) ' если были подвижки в списках, надо уведомить '############################################################################### function IsInBL(DNSBL_name, HOST2Chk) 'Оцениваем результаты пинга if Ping(RevIP(HOST2Chk) & "." & DNSBL_name) then 'если до сих пор в BL то. ' переформируем список заблокированных хостов для этого BL IsInBL = true if DNSBL.Item(DNSBL_name) = vbNullstring then DNSBL.Item(DNSBL_name) = HOST2Chk else DNSBL.Item(DNSBL_name) = DNSBL.Item(DNSBL_name) & "|" & HOST2Chk end if else IsInBL = false end if end function '############################################################################### Function Ping(Ip2Ping) 'пингуем хост Dim Hosts(), strComputer, objWMIService, colPings, objStatus Set objWMIService = GetObject("winmgmts:\\.\root\cimv2") Set colPings = objWMIService.ExecQuery _ ("Select * From Win32_PingStatus where Address = '" & Ip2Ping & "'") For Each objStatus In colPings If IsNull(objStatus.StatusCode) Or objStatus.StatusCode<>0 Then 'в принципе, уже не пингуется. но дополнительно проверим и IP(зарезолвился или нет) If objStatus.ProtocolAddress = vbNullstring Then Ping = False Else if StrComp(TestHost, Ip2Ping, vbTextcompare) <> 0 then WScript.Echo "ping host " & Ip2Ping & " . LISTED" wscript.echo "Return IP: " & objStatus.ProtocolAddress end if Ping = True End If Next End Function '############################################################################### Function RevIP(IP) ' "переворачиваем" IP-адрес Dim arrIPs, i RevIP = vbNullString arrIPs = Split(IP, ".", -1, vbTextCompare) If UBound(arrIPs) > 3 Then wscript.echo "Неверный IP! " & IP : wscript.quit For i = UBound(arrIPs) To LBound(arrIPs) step -1 If arrIPs(i) > 254 Then wscript.echo "Неверный IP! " & IP : wscript.quit If i = 3 Then RevIP = arrIPs(i) Else RevIP = RevIP & "." & arrIPs(i) Next End Function '############################################################################### ' чтение-создание ключей в реестре ' если Make = true, то записываем значение KeyValue в ключ ' если Make = false, то пытаемся считать ключ и при его отсутствии создаём с значением KeyValue Function DoTheKey(RegPath, RegKey, Make, KeyValue) If Make and not Write2Reg Then ' Есди писАть в реестр запрещено, то писАть в реестр нельзя Exit Function End If If Make Then ' если задача записать, то: WshShell.RegWrite RegPath & "\" & RegKey, KeyValue, "REG_SZ" Else ' если только прочесть, то всё немного сложнее :) On Error Resume Next ' половим ошибки при отсутствии ключа(вариант что прав на чтения не хватает не рассматривается) DoTheKey = WshShell.RegRead(RegPath & "\" & RegKey) If Err.Number <> 0 Then wscript.echo "не найден ключ или раздел в реестре: " & RegPath & "\" & RegKey Err.Clear ' Clear the error. WshShell.RegWrite RegPath & "\" & RegKey, KeyValue, "REG_SZ" ' если ключа нет, то создаём его и заносим в него переданное значение(KeyValue) If Err.Number = 0 Then wscript.echo "в реестре создан ключ: [" & RegPath & "\" & RegKey & "] со значением [" & KeyValue & "]." DoTheKey = WshShell.RegRead(RegPath & "\" & RegKey) End If Else ' wscript.echo "Значение ключа " & RegKey & " = [" & WshShell.RegRead(RegPath & "\" & RegKey) & "]" DoTheKey = WshShell.RegRead(RegPath & "\" & RegKey) End If Err.Clear ' Clear the error. On Error Goto 0 End If End Function '############################################################################### Sub SendMail(Subject, Body)' отправка уведомления через CDO Dim iMsg, iConf, Flds Set iMsg=CreateObject("CDO.Message") Set iConf=CreateObject("CDO.Configuration") Set Flds=iConf.Fields 'http://msdn.microsoft.com/en-us/library/ms873037(EXCHG.65).aspx 'The mechanism to use to send messages. ' cdoSendUsingPort (2) Flds.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2 'The authentication mechanism to use when authenticating to a SMTP service over the network. 'This field is relevant only if the http://schemas.microsoft.com/cdo/configuration/sendusing field is set to cdoSendUsingPort. Flds.Item("http://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout") = 10 Flds.Item("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate") = smtp_auth Flds.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = smtp_host Flds.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = smtp_port Flds.Item("http://schemas.microsoft.com/cdo/configuration/sendusername") = smtp_user Flds.Item("http://schemas.microsoft.com/cdo/configuration/sendpassword") = smtp_pass Flds.Item("http://schemas.microsoft.com/cdo/configuration/languagecode") = "ru" '? Flds.Update iMsg.Configuration = iConf iMsg.To = to_email iMsg.From = from_email iMsg.Subject = Subject iMsg.BodyPart.Charset = "windows-1251" iMsg.HtmlBody = Body iMsg.Send Set iMsg=Nothing Set iConf=Nothing Set Flds=Nothing End Sub
Принцип работы простой: два словаря(блэклисты и IP офисов и сервера), проверяем присутствие IP в чёрном списке(или исчезновение оттуда) и уведомляем об этом на почту. Список текущих блокировок хранится в реестре(я сохраняю в HKLM, чтобы можно было в любой момент без выкрутасов посмотреть что там ). Если IP уже числится в реестре, то по нему повторных отчётов не шлётся. Ну и чтобы для проверки наличия интернета пингуем гугл.
При отсутсвии ветки/параметра в реестре они создаются автоматически, в процессе работы параметры из этой ветки могут перезаписываться — несмотря на п.6.5 отключать запись в реестр по умолчанию не стал(переменная Write2Reg — рудимент, присутствующий у меня везде где есть зработа с реестром 
). Во-первых, данная ветка по умолчанию отсутствует, во-вторых, без неё полноценно скрипт функционировать не будет.
Метод проверки есть в скрипте, на википедии, в FAQ спамхауса(ссылки в коментариях скрипта), поэтому дублировать не буду.
Единственное что не протестировал — ситуацию с удалением IP из DNSBL — своих IP в блоках не имею(ттт), а чужие разблокировать не буду(ибо скорее всего спамерские — из логов сервера брал) — если кто-то может протестировать, буду рад. Или буду ждать попадания наших IP в BL.
Список DNSBL можно посмотреть здесь(кстати, удобный инструмент для ручной проверки попадания в BL).
P.S. Остался правда один момент — команда вроде такой «nslookup -type=ANY 103.63.250.194.b.barracudacentral.org» даёт больше информации, и если в случае с баракудой пользы от ней немного(выдаёт только ссылку на проверку IP), то для спамхауза это не так. У спамхауза в возвращаемом адресе «закодирован» как минимум список в который IP попал — но это в теории. В практике в спамхаузом пока не срабатывает (для IP из PBL-списка), впрочем я так до конца не понял систему взаимодействия их BL. Отсюда вопрос: есть ли под VBScript класс позволяющий выполнять запросы к DNS-серверу? В MSDN пока наткнулся на DNS WMI Provider, но беглый осмотр навёл на мысль что он предназначен для управления MS DNS-сервером. Глубже пока не копал — текущего скрипта мне достаточно(подробности через nslookup узнаю). В идеале обойтись без сторонних контролов
Bl spamcop net как разблокировать почту
SpamCop Blocking List
SpamCop Blocking List Details
The SpamCop Blocking List (SCBL) lists IP addresses which have transmitted reported email to SpamCop users. SpamCop, service providers and individual users then use the SCBL to block and filter unwanted email. The SCBL is a fast and automatic list of sites sending reported mail, fueled by a number of sources, including automated reports and SpamCop user submissions. The SCBL is time-based, resulting in quick and automatic delisting of these sites when reports stop.
- Learn more about the SpamCop Blocking List (SCBL)
- How to implement the SCBL
- Other information about the SCBL
Received a Report from SpamCop?
Start by following the link(s) in the email report you received from SpamCop. These links provide details about the reported email and SpamCop’s procedures. These links provide access to advanced options for analyzing and responding to reported spam.
- More information for report recipients
- Read or post to the SpamCop help forums
Implement the SCBL to Filter Spam
The SCBL aims to stop most spam while not blocking wanted email. This is a difficult task. It is not possible for any blocking tool to avoid blocking wanted mail entirely. Given the power of the SCBL, SpamCop encourages use of the SCBL in concert with an actively maintained allow list of wanted email senders. SpamCop encourages SCBL users to tag and divert email, rather than block it outright. Most SCBL users consider the amount of unwanted email successfully filtered to make the risks and additional efforts worthwhile.
The SCBL is aggressive and often errs on the side of blocking mail. When implementing the SCBL, provide users with the information about how the SCBL and your mail system filter their email. Ideally, they should have a choice of filtering options. Many mailservers operate with blocking lists in a «tag only» mode, which is preferable in many situations.
There is no warranty associated with using this system. It is provided as is.
© Cisco Systems, Inc. All rights reserved. HTML4 / CSS2 Firefox recommended — Policies and Disclaimers
Email is blocked by spamcop.net blacklist/blocklist service Print
As of Jan 31, 2021, the Spamcop project has come to an end, letting their domain expire, and is now returning a ‘failed’ result for all lookups. To fix this, remove the bl.spamcop.net server from your list of realtime block lists (RBLs).
With Plesk servers this is done by completing these steps:
- Login to Plesk as and admin capable user
- Go to Tools & Settings > Mail Server Settings
- Scroll to the bottom and look for the «DNS zones for DNSBL service» field. Ensure it does not have bl.spamcop.net in it
- Save settings
Problem solved! We have applied this change to all shared servers and VPS with Hands-On Management as of January 31, 2021.
All incoming mail blocked by bl.spamcop.net
Since a few hours all incoming mail was blocked by bl.spamcop.net We tried sending mails to ourself from gmx, gmail and microsoft.
The solution was to comment out spamcop in /etc/exim.conf
The spamcop site is unreachable (domain expired). Do others have the same problem (is something strange going on)?
This is the log entry from exim/mainlog:
H=mout.gmx.net [212.227.17.21] X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= <[email protected] > rejected RCPT <[email protected] >: Email blocked by bl.spamcop.net
Last edited: Jan 31, 2021
rvandam
Verified User
Joined Aug 28, 2009 Messages 39
This was the error I got trying to send from GMX to my own email:
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of
its recipients. This is a permanent error. The following address(es)
failed:
[email protected] :
SMTP error from remote server for RCPT TO command, host: myserver.nl (myip) reason: 550 Email blocked by bl.spamcop.net
akadi81
Verified User
Joined Feb 26, 2015 Messages 51
It seems that domain spamcop.net was not payed
Remove line witch contains bl.spamcop.net from exim.conf and restart exim.
Or update exim.conf to the latest version using custombuild.
Imtek
Verified User
Joined Dec 11, 2005 Messages 215 Location The Netherlands
Domain spamcop.net expired — emails are rejected if you use this rbl
Hi, Domain spamcop.net was expired, please note that cause reject all emails if you use this rbl in your exim.conf
forum.directadmin.com
Richard G
Verified User
Joined Jul 6, 2008 Messages 11,519 Location Maastricht
Please check forums before posting.
Spamcop will be back, is already resolving with some, so no need to remove it, or only for a short while.
LawsHosting
Verified User
Joined Sep 13, 2008 Messages 2,349 Location London UK
For them to not renew their domain is just stupid and bad for reputation, especially as they can break lots of MTAs.
rvandam
Verified User
Joined Aug 28, 2009 Messages 39
Sorry for not checking the forum before posting. The was stress involved I managed to resolve before posting, but I was sure others would have the same problem too.
Strange that a problem like this can shut down so many mail servers. This is more Exim related then Directadmin I think. Now working through 600+ log lines of rejected mail to see if we missed something important.
IT_Architect
Verified User
Joined Feb 27, 2006 Messages 1,107
Removing the spamcop area from exim.conf and restarting exim does not fix the problem.
ikkeben
Verified User
Joined May 22, 2014 Messages 1,557 Location Netherlands Germany
Removing the spamcop area from exim.conf and restarting exim does not fix the problem.
Her the exim.conf custombuild latest version is working, do you have used that for update, some custom or version somewhere because of exim version problems some had before?
ikkeben
Verified User
Joined May 22, 2014 Messages 1,557 Location Netherlands Germany
Sorry for not checking the forum before posting. The was stress involved I managed to resolve before posting, but I was sure others would have the same problem too.
Strange that a problem like this can shut down so many mail servers. This is more Exim related then Directadmin I think. Now working through 600+ log lines of rejected mail to see if we missed something important.
If done in time , they send again automaticly.
IT_Architect
Verified User
Joined Feb 27, 2006 Messages 1,107
Her the exim.conf custombuild latest version is working, do you have used that for update, some custom or version somewhere because of exim version problems some had before?
— It’s not standard, and I doubt anyones’ are these days, and it has worked perfectly until the spamcop issue.
— I turned off the firewall, which checks for crap, but that didn’t work.
— The file checks other sources that are downloaded daily so I’m guessing it blacklisted the whole world in one of those files. It looks like I auger through things to get things working today. It will tell me which sources use Spamcop and I’ll eliminate them.
factor
Verified User
Joined Jul 22, 2017 Messages 3,770 Location USA
spamcop expired — Google Search
www.google.com
Cisco forgot to renew the domain..HAHHAHAHA
factor
Verified User
Joined Jul 22, 2017 Messages 3,770 Location USA
in exim.conf near the top I have
RBL_DNS_LIST=\
cbl.abuseat.org : \
b.barracudacentral.org : \
zen.spamhaus.org
Maybe SpamCop was removed and some have custom config?
Last edited: Feb 1, 2021
IT_Architect
Verified User
Joined Feb 27, 2006 Messages 1,107
I tracked it down. The new /etc/exim.conf didn’t work right at all, so I put the original one back that I had edited out spamcop on. I did a grep -rli «bl.spamcop.net» /etc and found the definitive RBL_DNS_LIST is not located in /etc/exim.conf. It is overridden in /etc/exim.variables.conf. If you go to that file it says not to edit it directly, and to make an /etc/exim.variables.conf.custom. However, that does not work because there is no place where that gets included, not in /etc/exim.conf nor /etc/exim.variables.conf. It’s passing email now after I edited /etc/exim.variables.conf. Tonight I’ll sort out the mess, but for now email is working. I’ll probably make a /etc/exim.variables.conf.custom tonight and find or add a way to get it included after /etc/exim.variables.conf or add a line to /etc/exim.variables.conf. Perhaps the newer files have that fixed too.
Richard G
Verified User
Joined Jul 6, 2008 Messages 11,519 Location Maastricht
You could have used the /etc/exim.strings.conf.custom which are used to include or exclude RBL’s.
IT_Architect
Verified User
Joined Feb 27, 2006 Messages 1,107
You could have used the /etc/exim.strings.conf.custom which are used to include or exclude RBL’s.
Re-read what I wrote about that. It didn’t work and then I discovered why. Another thing that turned it into as big of a hairball as it did, and why I had some servers with no issues and some with issues is Spamcop had/has a 24hr TTL. So half of the queries elicited a response from a parking page indicating it is spam server and others hit the real spamcop servers where there would be a no response thereby indicating it was not a spam server.
Last edited: Feb 1, 2021
Richard G
Verified User
Joined Jul 6, 2008 Messages 11,519 Location Maastricht
Maybe you re-read what I wrote? I wasn’t talking about exim.variables.conf like you but about exim.STRINGS.conf.custom.
I don’t need to re-read what you wrote and I stay with my answer.
You have an odd configuration. Spamcop -is- listed in exim.conf and is not present in exim.variables.conf als you declare.
I am working with exim.strings.conf.custom for years with this and it’s working.
So you have probably an older exim.conf or some other reason why it was not working with you.
[root@server23: /etc]# grep -rli "bl.spamcop.net" /etc /etc/exim.conf /etc/exim.strings.conf.custom /etc/csf/csf.rblconfand I’ve not update exim.conf and put it myself in exim.strings.conf.custom.
floyd
Verified User
Joined Mar 29, 2005 Messages 6,064
It didn’t affect me at all since I don’t block spam and now I am very glad I don’t.
Richard G
Verified User
Joined Jul 6, 2008 Messages 11,519 Location Maastricht
Well. I have the same with spamhaus, which was blocking all my mail because it was looking at ISP ip it was send from instead of server ip the mail was send through via smtp. And lots of other false flagged positives. Which was the reason I started using the exim.strings.conf.custom in the first place. To exclude the spamhaus list.
Do you have better ones? I use barracuda, spamcop and abuseat, but improvement is always nice.
IT_Architect
Verified User
Joined Feb 27, 2006 Messages 1,107
Maybe you re-read what I wrote? I wasn’t talking about exim.variables.conf like you but about exim.STRINGS.conf.custom.
I don’t need to re-read what you wrote and I stay with my answer.
You have an odd configuration. Spamcop -is- listed in exim.conf and is not present in exim.variables.conf als you declare.
I am working with exim.strings.conf.custom for years with this and it’s working.
So you have probably an older exim.conf or some other reason why it was not working with you.
[root@server23: /etc]# grep -rli "bl.spamcop.net" /etc /etc/exim.conf /etc/exim.strings.conf.custom /etc/csf/csf.rblconfand I’ve not update exim.conf and put it myself in exim.strings.conf.custom.
root@server:~ # grep -rli «bl.spamcop.net» /etc
/etc/exim.conf
/etc/exim.variables.conf
/etc/exim.variables.conf.custom
My files were from 11/25/2018.
— I have the /etc/exim.strings.conf but of course it has only strings in it. I know you can do more with *.custom by reference by I wasn’t using it.
— I have no /etc/csf
I’m on the FreeBSD version. I’ll probably update and sort things out with some newer files because the configs from back then didn’t exactly work right. I’ve settled on and have been using:
RBL_DNS_LIST==\
cbl.abuseat.org : \
bl.spamcop.net : \
b.barracudacentral.org
Which has worked perfectly until this happened. My initial reaction is to dump spamcop.net, but it has been good until today, so I need to cool down so I don’t cut off my nose to spite my face. The former crew at CISCO are probably working on their resumes as we speak. I went through RBLs about 18 months ago, and found these to be common denominators for spam appliances. Yes, Barracuda makes appliances too, but I mean appliances that are not barracuda have them as one of their defaults.
The problem with spam is one man’s junk is another man’s treasure, so I’ve been using sa-learn/teach-isspam/teach-isnotspam method. It’s about phychic after a little training but every user dictates for all virtual users so I normally tell one person how to use it. I’ve set up both POP3 and IMAP on the same desktop client when desired so when ham comes in they can copy to teach-isnotspam and for spam drag to teach-isspam, and the every 5 minute cron will clean feed sa-learn and clean out the folder.