Showing posts with label DNSBL. Show all posts
Showing posts with label DNSBL. Show all posts

Wednesday, August 4, 2010

Lotus Protector compared to Barracuda - DNSBL differences

Barracuda uses it's own DNS block list or DNSBL or BRBL  (Barracuda reputation block list). This BRBL is a great resource for filtering unwanted spam. The great thing about Barracuda's RBL is that they offer it free of use within reason.


Disclaimer: You need to look up Barracuda Central's policy before considering the use of their RBL.


To get to the website, click on http://www.barracudacentral.org/

So in theory you can setup Lotus Protector to use Barracuda's RBL. I have done exactly that. Lotus protector provides some cool advantages over Barracuda though. The biggest advantage is how and when the DNSBL is used.

A little background on how Barracuda executes DNSBL: When you are using the BRBL in Barracuda, each connecting host is checked. If that host is contained in the BRBL, the host is dropped, not even an HELO or EHLO command is received. For this reason when you look at the message log you only see the connecting IP/domain server and that the connection was denied. You will never know what that message might have said. I understand the reasoning behind this which is to reduce the amount of bandwidth and traffic.

Lotus Protector has the same option. You click on SMTP -> Configuration, Receiving SMTP, DNSBL Settings and you can 'enable' DNSBL and customize the error message and error code that is sent to the connecting server when the connection is dropped.



This next paragraph does not apply to the above method of filtering with respect to threshold and matching. Note the disclaimer in the screen shot next to the enable check box. it states:
(uses DNSBL servers defined in Policy / Spam Settings, threshold and match scores are ignored!)
I am guessing that when a DNSBL server returns a known spam address, it is dropped but I can't verify that.

Once DNSBL is enabled, go to Mail Security -> Policy, Spam Settings. You will see a threshold number and a list of DNSBL servers. Each DNSBL server has a number associated called 'Match Score'. This basically means if the DNSBL server returns an address meaning the IP has a spam reputation, that score is compared to the threshold. If the score is greater then the threshold, the email is not accepted. If you have more than one server listed and enabled and the connecting host IP is listed in more then one DNSBL, the match score is added then compared to the Threshold.



Where Lotus Protector is different from Barracuda is that you can turn this DNSBL option off, and configure an analysis module to check the connecting IP in the policy rule! This allows me to submit a piece of email that is blocked by DNSBL to a person's spam quarantine or any other rule I decide to do! However if you are trying to reduce the amount of bandwidth, this policy rule might not be the best option for you. However this is great for testing purposes and that occasional person that sends an email to upper management using their local outlook client or that person that has an open relay but also has legitimate email too. Here are the screen shots of the DNSBL policy rule:


This screen shot shows the Analysis Module that checks for DNSBL


This screen shows the rule in place. The action is set to block since we do not want the email to continue being checked by the rest of the rules. The response is to store the email in the Quarantine where the individual user can look at it ( NOTE: make sure virus scanning is the first rule, you do not want to quarantine an email with a virus! ). Last, this rule is ran before the 'tag spam' rule and therefore reducing the amount of overhead.

On a side note, when configuring the Barracuda RBL in protector, the address is
b.barracudacentral.org
not
2.0.0.127.b.barracudacentral.org.
There is a link to 'how to use' the BRBL and it doesn't display b.barracuda.org as the DNSBL server name.  For a noob like me it threw me off because of the example used was 2.0.0.127.b.barracudacentral.org.
( http://www.barracudacentral.org/rbl/how-to-use ) Also before you enable this you must register your Lotus Protector IP address to gain access:

DNSBL

I finally realize how DNSBL or DNS block lists work. If you ask me, it's pretty smart. It uses DNS to quickly and easily respond to a requesting mail server to determine the reputation of a connecting IP address. Also, DNSBL can be used for other applications besides email ( think http authentication ).

Let's start with an example and I will explain from there. When looking up an IP address for a domain or finding a domain using an IP, Windows users use nslookup. To do this, they type the following in a command prompt


C:\Users\>nslookup blog.theozzyblogger.com
Server:  Home
Address:  XXX.XXX.XXX.XXX


Non-authoritative answer:
Name:    ghs.l.google.com
Address:  74.125.95.121
Aliases:  blog.theozzyblogger.com
          ghs.google.com

The first two lines that say server and address is the name of my DNS server and my DNS server IP address. I purposely changed it to concealed them :)

This displays the IP address associated with my web site, blog.theozzyblogger.com. The way DNSBL works, that you prefix the IP address in front of the DNS name. However, you need to reverse the IP address. So lets say I want to look up the IP address reputation of my website, 74.125.95.121. I will use spamhaus ZEN DNSBL filter: ( http://www.spamhaus.org/zen/ )

it will look like this
121.95.125.74.zen.spamhaus.org

or


C:\Users\>nslookup 121.95.125.74.zen.spamhaus.org
Server:  Home
Address:  XXX.XXX.XXX.XXX


*** Home can't find 121.95.125.74.zen.spamhaus.org: Non-existent domain




When Non-existent domain is returned that means the IP is not listed as a known spam address. When an email server or spam device receives this Non-existent domain, the email will be allowed to receive. But when an address is returned, that means the IP has a reputation for spam like this random address of 93.45.76.93:


C:\Users\>nslookup 93.76.45.93.zen.spamhaus.org
Server:  Home
Address:  XXX.XXX.XXX.XXX


Non-authoritative answer:
Name:    93.76.45.93.zen.spamhaus.org
Address:  127.0.0.11

Spamhaus has representations of what the return addresses means as do all the DNSBL's, in this case 127.0.0.11 means this IP address is listed as an IP which should not be delivering unauthenticated SMTP email:
(http://www.spamhaus.org/faq/answers.lasso?section=DNSBL%20Usage#202)









Here is a good reference too:
http://www.spamhaus.org/faq/answers.lasso?section=DNSBL%20Usage#252
My favorite MX and blacklist website
http://www.mxtoolbox.com/
http://www.mxtoolbox.com/blacklists.aspx