DNSBL Server - Revision history

Digitaltinker at 02:58, 5 January 2023

2023-01-05T02:58:27Z

← Older revision		Revision as of 19:58, 4 January 2023
Line 218:		Line 218:
	notspam A 127.0.0.2		notspam A 127.0.0.2
	</pre>		</pre>

			[[Category:Project]]

Ajstadlin at 04:31, 19 January 2014

2014-01-19T04:31:23Z

← Older revision		Revision as of 21:31, 18 January 2014
Line 1:		Line 1:
	= DNSBL Concepts =		= DNSBL Concepts =
			Updated Jan 18, 2014 ajs

	== What is a DNSBL? ==		== What is a DNSBL? ==
	A DNSBL, DNS Black(or Block) List server is simply a DNS server used to determine if an IPv4 address has a record, "is listed", in a blocklist server's domain. A DNSBL is used as a second (assuming the firewall is the first) defense check used to determine if a sending server should be prohibited from connecting to your email server.		A DNSBL, DNS Black(or Block) List server is simply a DNS server used to determine if an IPv4 address has a record, "is listed", in a blocklist server's domain. A DNSBL is used as a second (assuming the firewall is the first) defense check used to determine if a sending server should be prohibited from connecting to your email server.
Line 28:		Line 30:

	DNS Servers are generally light weight and high performance. A decent DNS Server can handle millions of DNSBL records and process hundreds of queries per second.		DNS Servers are generally light weight and high performance. A decent DNS Server can handle millions of DNSBL records and process hundreds of queries per second.

			= Linux Based DNSBL Implementation =
			== Requirements ==

	= Windows Based DNSBL Implementation =		= Windows Based DNSBL Implementation =
Line 79:		Line 84:

	<strong>Congratulations! You have completed the DNSBL Server setup!</strong>		<strong>Congratulations! You have completed the DNSBL Server setup!</strong>

			==== Create a Zone and Delegation Name Server for the DNS White List ====
			11. Right click the ''Forward Lookup Zones'' and select the ''New Zone...'' menu item.
			12. Create a ''Primary Zone'' named '''dnswl.emaillab.net'''; finish the dialog (defaults are ok)
			13. Right Click on the ''emaillab.net'' domain and select the ''New Delegation...'' menu item.
			14. Enter '''dnswl''' for the Delegated Domain field; click Next
			15. Add a Name server with FQDN = ''email-lab-dnsbl'' and Resolve IP address = 172.30.10.53
			16. Finish the New Delegation wizard.

			<strong>Congratulations! You have completed the DNSBL Server setup!</strong>

			* FAQ = Why use <i>Delegations</i> instead of just using Forward Zones?
			Using a simpler Forward Zone works fine! The purpose for using Delegations is to make it simple to adapt this lab example to a scenario where the DNS server with the actual DNSBL and DNSWL zones is not in your network and the zones for dnsbl.emaillab.net and dnswl.emaillab.net use the same "emaillab.net" domain.<br />

			For example, if I want to enable a friend's remote DNS server to use the DNSBL.emaillab.net and DNSWL.emaillab.net running on my DNS server privately, without using a public registered Internet domain name, all they have to do is create a zone and delegation records for the right IP address.

	=== EMail Lab Exercise - Adding DNS Records to your DNSBL Server ===		=== EMail Lab Exercise - Adding DNS Records to your DNSBL Server ===
Line 106:		Line 126:
	2. Add a <b>Host(A)</b> record for <b>*.10.30.172</b> with IP Address <b>127.0.0.2</b>		2. Add a <b>Host(A)</b> record for <b>*.10.30.172</b> with IP Address <b>127.0.0.2</b>
	3. Test by "ping 22.10.30.172.dnswl.emaillab.net" and it will resolve to 127.0.0.2		3. Test by "ping 22.10.30.172.dnswl.emaillab.net" and it will resolve to 127.0.0.2
	~~4. Test any IP address in the 172.30.10.0/24 subnet and it will resolve to 127.0.0.2~~

	[~~[File~~:~~EMail~~-~~Lab~~-~~DNS 001~~.~~png~~]]		=== Scripting Windows DNS Entries ===
			DNS Entries can be scripted using the DNSCMD.EXE console command program. The following is an example for adding (A) Host record for IPv4 Network 37.30.23.0/24 to the DNSBL's DNS. My personal practice is to also add a (TXT) DNS record with some reference information like the original reverse DNS PTR Lookup results and a datetime stamp.
			dnscmd localhost /RecordAdd dnsbl.emaillab.net *.23.30.37 1200 A 127.0.0.2
			dnscmd localhost /RecordAdd dnsbl.emaillab.net *.23.30.37 1200 TXT "IP BLOCK 37.30.23.0/24" "37.30.23.86.nat.umts.dynamic.t-mobile.pl" "[20140115184406]"

			More script example:
			dnscmd localhost /RecordAdd dnsbl.emaillab.net *.44.202.50 1200 A 127.0.0.2
			dnscmd localhost /RecordAdd dnsbl.emaillab.net *.44.202.50 1200 TXT "IP BLOCK 50.202.44.0/24" "50-202-44-58-static.hfc.comcastbusiness.net" "[20140117084009]"

			dnscmd localhost /RecordAdd dnsbl.emaillab.net *.56.156.212 1200 A 127.0.0.2
			dnscmd localhost /RecordAdd dnsbl.emaillab.net *.56.156.212 1200 TXT "IP BLOCK 212.156.56.0/24" "212.156.56.62.static.turktelekom.com.tr" "[20140118215557]"

	=== DNS Data Files ===		=== DNS Data Files ===
Line 117:		Line 146:
	; Zone version: 9		; Zone version: 9
	;		;

	@ IN SOA email-lab-dnsbl. hostmaster. (		@ IN SOA email-lab-dnsbl. hostmaster. (
	9 ; serial number		9 ; serial number
Line 124:		Line 152:
	86400 ; expire		86400 ; expire
	3600 ) ; default TTL		3600 ) ; default TTL

	;		;
	; Zone NS records		; Zone NS records
	;		;

	@ NS email-lab-dnsbl.		@ NS email-lab-dnsbl.
	email-lab-dnsbl. 0 A 172.30.10.53		email-lab-dnsbl. 0 A 172.30.10.53

	;		;
	; Zone records		; Zone records
	;


	;		;
	; Delegated sub-zone: dnsbl.emaillab.net.		; Delegated sub-zone: dnsbl.emaillab.net.
Line 143:		Line 165:
	email-lab-dnsbl. 0 A 172.30.10.53		email-lab-dnsbl. 0 A 172.30.10.53
	; End delegation		; End delegation


	;		;
	; Delegated sub-zone: dnswl.emaillab.net.		; Delegated sub-zone: dnswl.emaillab.net.
Line 159:		Line 179:
	; Zone version: 5		; Zone version: 5
	;		;

	@ IN SOA email-lab-dnsbl. hostmaster. (		@ IN SOA email-lab-dnsbl. hostmaster. (
	5 ; serial number		5 ; serial number
Line 166:		Line 185:
	86400 ; expire		86400 ; expire
	3600 ) ; default TTL		3600 ) ; default TTL

	;		;
	; Zone NS records		; Zone NS records
	;		;

	@ NS email-lab-dnsbl.		@ NS email-lab-dnsbl.

	;		;
	; Zone records		; Zone records
	;		;

	66.77.88.99 A 127.0.0.2		66.77.88.99 A 127.0.0.2
	spam A 127.0.0.2		spam A 127.0.0.2
Line 187:		Line 202:
	; Zone version: 7		; Zone version: 7
	;		;

	@ IN SOA email-lab-dnsbl. hostmaster. (		@ IN SOA email-lab-dnsbl. hostmaster. (
	7 ; serial number		7 ; serial number
Line 194:		Line 208:
	86400 ; expire		86400 ; expire
	3600 ) ; default TTL		3600 ) ; default TTL

	;		;
	; Zone NS records		; Zone NS records
	;		;

	@ NS email-lab-dnsbl.		@ NS email-lab-dnsbl.

	;		;
	; Zone records		; Zone records
	;		;

	*.10.30.172 A 127.0.0.2		*.10.30.172 A 127.0.0.2
	notspam A 127.0.0.2		notspam A 127.0.0.2
	</pre>		</pre>

Ajstadlin: /* Add Host(A) Records for DNSBL Formatted FQDNs */

2014-01-14T04:07:15Z

Add Host(A) Records for DNSBL Formatted FQDNs

← Older revision		Revision as of 21:07, 13 January 2014
Line 106:		Line 106:
	2. Add a <b>Host(A)</b> record for <b>*.10.30.172</b> with IP Address <b>127.0.0.2</b>		2. Add a <b>Host(A)</b> record for <b>*.10.30.172</b> with IP Address <b>127.0.0.2</b>
	3. Test by "ping 22.10.30.172.dnswl.emaillab.net" and it will resolve to 127.0.0.2		3. Test by "ping 22.10.30.172.dnswl.emaillab.net" and it will resolve to 127.0.0.2
			4. Test any IP address in the 172.30.10.0/24 subnet and it will resolve to 127.0.0.2

	[[File:EMail-Lab-DNS 001.png]]		[[File:EMail-Lab-DNS 001.png]]

Ajstadlin: /* Add Host(A) Records for DNSBL Formatted FQDNs */

2014-01-14T04:05:58Z

Add Host(A) Records for DNSBL Formatted FQDNs

← Older revision		Revision as of 21:05, 13 January 2014
Line 107:		Line 107:
	3. Test by "ping 22.10.30.172.dnswl.emaillab.net" and it will resolve to 127.0.0.2		3. Test by "ping 22.10.30.172.dnswl.emaillab.net" and it will resolve to 127.0.0.2

	[File:EMail-Lab-DNS 001.png]		[[File:EMail-Lab-DNS 001.png]]

	=== DNS Data Files ===		=== DNS Data Files ===

Ajstadlin: /* DNS Data Files */

2014-01-14T04:05:27Z

DNS Data Files

← Older revision		Revision as of 21:05, 13 January 2014
Line 106:		Line 106:
	2. Add a <b>Host(A)</b> record for <b>*.10.30.172</b> with IP Address <b>127.0.0.2</b>		2. Add a <b>Host(A)</b> record for <b>*.10.30.172</b> with IP Address <b>127.0.0.2</b>
	3. Test by "ping 22.10.30.172.dnswl.emaillab.net" and it will resolve to 127.0.0.2		3. Test by "ping 22.10.30.172.dnswl.emaillab.net" and it will resolve to 127.0.0.2

			[File:EMail-Lab-DNS 001.png]

	=== DNS Data Files ===		=== DNS Data Files ===

Ajstadlin: /* Linux Based DNSBL Implementation */

2014-01-14T04:01:59Z

Linux Based DNSBL Implementation

← Older revision		Revision as of 21:01, 13 January 2014
Line 28:		Line 28:

	DNS Servers are generally light weight and high performance. A decent DNS Server can handle millions of DNSBL records and process hundreds of queries per second.		DNS Servers are generally light weight and high performance. A decent DNS Server can handle millions of DNSBL records and process hundreds of queries per second.

	~~= Linux Based DNSBL Implementation =~~
	~~== Requirements ==~~

	= Windows Based DNSBL Implementation =		= Windows Based DNSBL Implementation =

Ajstadlin at 04:01, 14 January 2014

2014-01-14T04:01:27Z

Show changes

Ajstadlin: /* DNSBL Setup Details */

2014-01-12T17:30:48Z

DNSBL Setup Details

← Older revision		Revision as of 10:30, 12 January 2014
Line 35:		Line 35:
	* Windows Server 2000 or later		* Windows Server 2000 or later
	* Microsoft DNS Server		* Microsoft DNS Server
	== DNSBL Setup Details ==		== DNSBL DNS Host Setup Details ==
			If you are just USING a DNSBL in email or spam filtering, you do not need to do any of this. The following host setup procedure is for configuring a private DNSBL in your DNS Server.

			=== DNSBL Domain Delegations ===

	The following details are a snippet from [http://wiki.gridtrak.com/wiki/index.php/DNSBL AJ's DNSBL Notes].<br />		The following details are a snippet from [http://wiki.gridtrak.com/wiki/index.php/DNSBL AJ's DNSBL Notes].<br />
	~~This procedure has not yet been revised for use in the EMail Lab.~~

	==== Windows DNS - ''New Zone...'' Wizard ====		==== Windows DNS - ''New Zone...'' Wizard ====
	1. Right click the ''Forward Lookup Zones'' and select the ''New Zone...'' menu item.		1. Right click the ''Forward Lookup Zones'' and select the ''New Zone...'' menu item.
	2. Create a ''Primary Zone'' named '''~~regedit64~~.net'''; finish the dialog (defaults are ok)		2. Create a ''Primary Zone'' named '''emaillab.net'''; finish the dialog (defaults are ok)
	3. Right click on the ''~~regedit64~~.net'' domain and select the ''New Host (A)...'' menu item.		3. Right click on the ''emaillab.net'' domain and select the ''New Host (A)...'' menu item.
	4. Create a host record: Name = ''~~www~~''; IP Address = 69.~~243~~.34.~~230~~; close the New Host dialog		4. Create a host record: Name = ''dns0''; IP Address = 192.168.0.64; close the New Host dialog

	Create a Delegation Name Server for the DNS Black List		Create a Zone and Delegation Name Server for the DNS Black List
	5. Right Click on the ''~~regedit64~~.net'' domain and select the ''New Delegation...'' menu item.		5. Right click the ''Forward Lookup Zones'' and select the ''New Zone...'' menu item.
	6. Enter '''dnsbl''' for the Delegated Domain field; click Next		6. Create a ''Primary Zone'' named '''dnsbl.emaillab.net'''; finish the dialog (defaults are ok)
	+ Add a Name server with FQDN = ''~~www~~.~~regedit64~~.net'' and IP address = 69.~~243~~.34.~~230~~		7. Right Click on the ''emaillab.net'' domain and select the ''New Delegation...'' menu item.
			8. Enter '''dnsbl''' for the Delegated Domain field; click Next
			+ Add a Name server with FQDN = ''dns0.emaillab.net'' and IP address = 192.168.0.64
	Finish the New Delegation wizard.		Finish the New Delegation wizard.

	Create a Delegation Name Server for the DNS White List		Create a Delegation Name Server for the DNS White List
	7. Right Click on the ''~~regedit64~~.net'' domain and select the ''New Delegation...'' menu item.		9 Right click the ''Forward Lookup Zones'' and select the ''New Zone...'' menu item.
	8. Enter '''dnswl''' for the Delegated Domain field; click Next		10. Create a ''Primary Zone'' named '''dnswl.emaillab.net'''; finish the dialog (defaults are ok)
	~~+ Add a Name server with FQDN = ''www.regedit64.net'' and IP address = 69.243.34.230~~		11. Right Click on the ''emaillab.net'' domain and select the ''New Delegation...'' menu item.
	~~Finish the New Delegation wizard.~~		12. Enter '''dnswl''' for the Delegated Domain field; click Next

	<strong>You have completed the DNSBL setup</strong>		<strong>You have completed the DNSBL setup</strong>
	~~lkjljk~~

	==== DNS Data File ====		==== DNS Data File ====
	Here is a sample ~~regedit64~~.net.dns file from a Windows 2003 DNS server. Usually the LAN info is automatically generated by the ''New Zone'' wizard.		Here is a sample emaillab.net.dns file from a Windows 2003 DNS server. Usually the LAN info is automatically generated by the ''New Zone'' wizard.
	; Database file ~~regedit64~~.net.dns for ~~regedit64~~.net zone.		; Database file emaillab.net.dns for emaillab.net zone.
	; Zone version: 123		; Zone version: 123
	@ IN SOA ~~YOurLANDomain~~.com. hostmaster. (		@ IN SOA emaillab.com. hostmaster. (
	123 ; serial number		123 ; serial number
	900 ; refresh		900 ; refresh
Line 72:		Line 76:
	; Zone NS records		; Zone NS records
	;		;
	@ NS ~~YOUR_LAN_DNS_Server~~@~~YourLANDomain~~.com.		@ NS dnsman@emaillab.com.
	~~YourLANDomain~~.com. A ~~yourLANdnsIPAddress~~		emaillab.com. A 192.168.0.53

	; Zone records		; Zone records
	;		;
	; Delegated sub-zone: dnsbl.~~regedit64~~.net.		; Delegated sub-zone: dnsbl.emaillab.net.
	; Note: This is the DNS Black List		; Note: This is the DNS Black List
	dnsbl NS dnsbl.~~regedit64~~.net.		dnsbl NS dnsbl.emaillab.net.
	dnsbl A 69.~~243~~.34.~~230~~		dnsbl A 192.168.0.64
	; End delegation		; End delegation

	; Delegated sub-zone: dnswl.~~regedit64~~.net.		; Delegated sub-zone: dnswl.emaillab.net.
	; Note: This is a DNS White List		; Note: This is a DNS White List
	dnswl NS dnswl.~~regedit64~~.net.		dnswl NS dnswl.emaillab.net.
	dnswl A 69.~~243~~.34.~~230~~		dnswl A 192.168.0.64
	; End delegation		; End delegation

	www A 69.~~243~~.34.~~230~~		www A 192.168.0.64

Ajstadlin: /* Windows Based DNSBL Implementation */ DNSBL Setup Details snippet from my notes added

2014-01-12T16:34:04Z

Windows Based DNSBL Implementation: DNSBL Setup Details snippet from my notes added

← Older revision		Revision as of 09:34, 12 January 2014
Line 35:		Line 35:
	* Windows Server 2000 or later		* Windows Server 2000 or later
	* Microsoft DNS Server		* Microsoft DNS Server
			== DNSBL Setup Details ==
			The following details are a snippet from [http://wiki.gridtrak.com/wiki/index.php/DNSBL AJ's DNSBL Notes].<br />
			This procedure has not yet been revised for use in the EMail Lab.

			==== Windows DNS - ''New Zone...'' Wizard ====
			1. Right click the ''Forward Lookup Zones'' and select the ''New Zone...'' menu item.
			2. Create a ''Primary Zone'' named '''regedit64.net'''; finish the dialog (defaults are ok)
			3. Right click on the ''regedit64.net'' domain and select the ''New Host (A)...'' menu item.
			4. Create a host record: Name = ''www''; IP Address = 69.243.34.230; close the New Host dialog

			Create a Delegation Name Server for the DNS Black List
			5. Right Click on the ''regedit64.net'' domain and select the ''New Delegation...'' menu item.
			6. Enter '''dnsbl''' for the Delegated Domain field; click Next
			+ Add a Name server with FQDN = ''www.regedit64.net'' and IP address = 69.243.34.230
			Finish the New Delegation wizard.

			Create a Delegation Name Server for the DNS White List
			7. Right Click on the ''regedit64.net'' domain and select the ''New Delegation...'' menu item.
			8. Enter '''dnswl''' for the Delegated Domain field; click Next
			+ Add a Name server with FQDN = ''www.regedit64.net'' and IP address = 69.243.34.230
			Finish the New Delegation wizard.

			<strong>You have completed the DNSBL setup</strong>
			lkjljk

			==== DNS Data File ====
			Here is a sample regedit64.net.dns file from a Windows 2003 DNS server. Usually the LAN info is automatically generated by the ''New Zone'' wizard.
			; Database file regedit64.net.dns for regedit64.net zone.
			; Zone version: 123
			@ IN SOA YOurLANDomain.com. hostmaster. (
			123 ; serial number
			900 ; refresh
			600 ; retry
			86400 ; expire
			3600 ) ; default TTL
			; Zone NS records
			;
			@ NS YOUR_LAN_DNS_Server@YourLANDomain.com.
			YourLANDomain.com. A yourLANdnsIPAddress

			; Zone records
			;
			; Delegated sub-zone: dnsbl.regedit64.net.
			; Note: This is the DNS Black List
			dnsbl NS dnsbl.regedit64.net.
			dnsbl A 69.243.34.230
			; End delegation

			; Delegated sub-zone: dnswl.regedit64.net.
			; Note: This is a DNS White List
			dnswl NS dnswl.regedit64.net.
			dnswl A 69.243.34.230
			; End delegation

			www A 69.243.34.230

Ajstadlin: /* Why Would a Company Want its Own DNSBL? */

2014-01-12T16:26:41Z

Why Would a Company Want its Own DNSBL?

← Older revision		Revision as of 09:26, 12 January 2014
Line 12:		Line 12:
	* There are unlisted bad guys sending spam or malware to your company		* There are unlisted bad guys sending spam or malware to your company
	* Your company receives more than 1000 emails per day or otherwise exceeds the "free use" policies of the DNSBL services.		* Your company receives more than 1000 emails per day or otherwise exceeds the "free use" policies of the DNSBL services.
	* ~~It makes you feel better when You stop a spammer from connecting to~~ your server.		* Local DNSBL performance reduces your email server's work load and idle time waiting for public DNSBL response.

	=== Pros and Cons of Running a Private DNSBL ===		=== Pros and Cons of Running a Private DNSBL ===