DNSBL Server

DNSBL Concepts

What is a DNSBL?

A DNSBL, DNS Black(or Block) List server is simply a DNS server used to determine if an IPv4 address has a record, "is listed", in a blocklist server's domain. A DNSBL is used as a second (assuming the firewall is the first) defense check used to determine if a sending server should be prohibited from connecting to your email server.

Typical IP addresses listed in a DNSBL

• Known Repeat Spam sources
• Commercial ISP DHCP address ranges whose customers should be using the ISP's email services
• Rogue IP addresses that are unregistered

Why Would a Company Want its Own DNSBL?

Good question! There are free, public, DNSBLs, so why have your own?

• There are unlisted bad guys sending spam or malware to your company
• Your company receives more than 1000 emails per day or otherwise exceeds the "free use" policies of the DNSBL services.
• Local DNSBL performance reduces your email server's work load and idle time waiting for public DNSBL response.

Pros and Cons of Running a Private DNSBL

• PRO: Your email server can more efficiently identify and drop connections from repeat offenders. Public DNSBLs are slower to respond.
• PRO: It makes you feel good when you can block an annoyance and they have to ask You to unblock them.
• CON: Some of your customers, suppliers, and consultants use the same email services that send spam. If not careful, you might block a spammer and your customer with the same listing. (e.g. accidentally block email from yahoo.com servers).
• CON: The Internet IP address space is BIG (even for IPv4) and the process of identifying list candidates is a tedious maintenance task.

How Does a DNSBL Work?

A DNSBL server has one or more domains with records that are structured for storing IPv4 Addresses for efficient reverse lookup within the zone.

The storage and lookup process is similar to a Reverse Lookup used to find a FQDN (Fully Qualified Domain Name) for an IP address. The difference is that a DNSBL lookup is a Forward Lookup that looks up a FQDN constructed using the reverse IP Address and the DNSBL server's domain then resolves it to an IP address. The IP addresses returned by a DNSBL are typically 127.0.0.2 to 127.0.0.254.

Windows Based DNSBL Implementation

Requirements

• Windows Server 2000 or later
• Microsoft DNS Server

DNSBL Setup Details

The following details are a snippet from AJ's DNSBL Notes.
This procedure has not yet been revised for use in the EMail Lab.

Windows DNS - New Zone... Wizard

1.  Right click the Forward Lookup Zones and select the New Zone... menu item.
2.  Create a Primary Zone named regedit64.net;  finish the dialog (defaults are ok)
3.  Right click on the regedit64.net domain and select the New Host (A)... menu item.
4.  Create a host record:  Name = www; IP Address = 69.243.34.230; close the New Host dialog

Create a Delegation Name Server for the DNS Black List

5.  Right Click on the regedit64.net domain and select the New Delegation... menu item.
6.  Enter dnsbl for the Delegated Domain field; click Next
    +  Add a Name server with FQDN = www.regedit64.net and IP address = 69.243.34.230
    Finish the New Delegation wizard.
    

Create a Delegation Name Server for the DNS White List

7.  Right Click on the regedit64.net domain and select the New Delegation... menu item.
8.  Enter dnswl for the Delegated Domain field; click Next
    +  Add a Name server with FQDN = www.regedit64.net and IP address = 69.243.34.230
    Finish the New Delegation wizard.

You have completed the DNSBL setup lkjljk

DNS Data File

Here is a sample regedit64.net.dns file from a Windows 2003 DNS server. Usually the LAN info is automatically generated by the New Zone wizard.

;  Database file regedit64.net.dns for regedit64.net zone.
;      Zone version:  123
@                       IN  SOA YOurLANDomain.com.  hostmaster. (
                       	123          ; serial number
                       	900          ; refresh
                       	600          ; retry
                       	86400        ; expire
                       	3600       ) ; default TTL
;  Zone NS records
;
@                      NS	YOUR_LAN_DNS_Server@YourLANDomain.com.
YourLANDomain.com.     A	yourLANdnsIPAddress

;  Zone records
;
;  Delegated sub-zone:  dnsbl.regedit64.net.
;  Note:  This is the DNS Black List
dnsbl                   NS	dnsbl.regedit64.net.
dnsbl                   A	69.243.34.230
;  End delegation

;  Delegated sub-zone:  dnswl.regedit64.net. 
;  Note:  This is a DNS White List
dnswl                   NS	dnswl.regedit64.net.
dnswl                   A	69.243.34.230
;  End delegation

www                     A	69.243.34.230