The dnsbl.conf configuration file is specified by this partial bnf description. Comments start with // or # and extend to the end of the line. To include the contents of some file verbatim in the dnsbl.conf file, use
include "<file>";
CONFIG = {CONTEXT ";"}+ CONTEXT = "context" NAME "{" {STATEMENT}+ "}" STATEMENT = (DNSBL | DNSBLLIST | CONTENT | ENV-TO | VERIFY | GENERIC | AUTOWHITE | CONTEXT | ENV-FROM | RATE-LIMIT) ";" DNSBL = "dnsbl" NAME DNSPREFIX ERROR-MSG1 DNSBLLIST = "dnsbl_list" {NAME}+ CONTENT = "content" ("on" | "off") "{" {CONTENT-ST}+ "}" CONTENT-ST = (FILTER | URIBL | IGNORE | TLD | CCTLD | HTML-TAGS | HTML-LIMIT | HOST-LIMIT | SPAMASS) ";" SPAMASS = "spamassassin" INTEGER FILTER = "filter" DNSPREFIX ERROR-MSG2 URIBL = "uribl" DNSPREFIX ERROR-MSG3 IGNORE = "ignore" "{" {HOSTNAME [";"]}+ "}" TLD = "tld" "{" {TLD [";"]}+ "}" CCTLD = "cctld" "{" {TLD [";"]}+ "}" HTML-TAGS = "html_tags" "{" {HTMLTAG [";"]}+ "}" ERROR-MSG1 = string containing exactly two %s replacement tokens both are replaced with the client ip address ERROR-MSG2 = string containing exactly two %s replacement tokens the first is replaced with the hostname, and the second is replaced with the ip address ERROR-MSG3 = string containing exactly two %s replacement tokens both are replaced with the hostname HTML-LIMIT = "html_limit" ("on" INTEGER ERROR-MSG | "off") HOST-LIMIT = "host_limit" ("on" INTEGER ERROR-MSG | "off" | "soft" INTEGER) ENV-TO = "env_to" "{" {(TO-ADDR | DCC-TO)}+ "}" TO-ADDR = ADDRESS [";"] DCC-TO = "dcc_to" ("ok" | "many") "{" DCCINCLUDEFILE "}" ";" VERIFY = "verify" HOSTNAME ";" GENERIC = "generic" REGULAREXPRESSION ERROR-MSG4 ";" ERROR-MSG4 = string containing exactly one %s replacement token which is replaced with the client name AUTOWHITE = "autowhite" DAYS FILENAME ";" ENV_FROM = "env_from" [DEFAULT] "{" {(FROM-ADDR | DCC-FROM)}+ "}" FROM-ADDR = ADDRESS VALUE [";"] DCC-FROM = "dcc_from" "{" DCCINCLUDEFILE "}" ";" RATE-LIMIT = "rate_limit" [DEFAULTLIMIT] "{" (RATE)+ "}" RATE = USER LIMIT [";"] DEFAULT = ("white" | "black" | "unknown" | "inherit" | "") ADDRESS = (USER@ | DOMAIN | USER@DOMAIN) VALUE = ("white" | "black" | "unknown" | "inherit" | CHILD-CONTEXT-NAME)
context main-default { // outbound dnsbl filtering to catch our own customers that end up on the sbl dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; dnsbl_list sbl; // outbound content filtering to prevent our own customers from sending spam content on { filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.rulesemporium.com/cgi-bin/uribl.cgi?bl0=1&domain0=%s"; #uribl black.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; ignore { include "hosts-ignore.conf"; }; tld { include "tld.conf"; }; cctld { include "cctld.conf"; }; html_tags { include "html-tags.conf"; }; html_limit on 20 "Mail containing excessive bad html tags rejected"; html_limit off; host_limit on 20 "Mail containing excessive host names rejected"; host_limit soft 20; spamassassin 4; }; // backscatter prevention - don't send bounces for mail that we accepted but could not forward // we only send bounces to our own customers env_from unknown { "<>" black; }; // hourly recipient rate limit by smtp auth client id rate_limit 30 { // default #fred 100; // override default limits #joe 10; // "" }; }; context main { dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; dnsbl sbl zen.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s"; dnsbl_list local sbl; content on { filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.rulesemporium.com/cgi-bin/uribl.cgi?bl0=1&domain0=%s"; #uribl black.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; ignore { include "hosts-ignore.conf"; }; tld { include "tld.conf"; }; cctld { include "cctld.conf"; }; html_tags { include "html-tags.conf"; }; html_limit off; host_limit soft 20; spamassassin 5; }; generic "(^|[.-])(ppp|h|host)?([0-9]{1,3}[.-](Red-|dynamic[.-])?){4}" "your mail server %s seems to have a generic name"; env_to { # !! replace this with your domain names # child contexts are not allowed to specify recipient addresses outside these domains include "/etc/mail/local-host-names"; }; context whitelist { content off {}; env_to { # dcc_to ok { include "/var/dcc/whitecommon"; }; }; env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted # so all mail TO these env_to addresses is accepted }; context abuse { dnsbl_list xbl; content off {}; generic "^$ " " "; # regex cannot match, to disable generic rdns rejects env_to { abuse@ # no content filtering on abuse reports postmaster@ # "" }; env_from unknown {}; # ignore all parent white/black listing }; context minimal { dnsbl_list sbl; content on {}; spamassassin 10; generic "^$ " " "; # regex cannot match, to disable generic rdns rejects env_to { }; }; context blacklist { env_to { # dcc_to many { include "/var/dcc/whitecommon"; }; }; env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted # so all mail TO these env_to addresses is rejected }; env_from unknown { abuse@ abuse; # replies to abuse reports use the abuse context # dcc_from { include "/var/dcc/whitecommon"; }; }; autowhite 90 "autowhite/my-auto-whitelist"; # install should create /etc/dnsbl/autowhite writable by userid dnsbl };