RFCI publishes a number of usefull lists that can be used to effectively filter incoming email. One of the most usefull is bogusmx.rfc-ignorant.org which essentialy is a DNSBL that contains domain names with bogus MX servers (like localhost, and so on):

” If any publicly listed MX record for domain contains a hostname which points to bogus IP address space, such as those documented in RFC 3330, or if the domain contains an MX RR that points to an IP address, in violation of RFC 1035 or if the domain has MX RRs which point to hostnames which themselves do not have an associated A record (including MXs which return an NXDOMAIN, or which are CNAMEs)”.

If you are a sendmail user,the trouble with bogusmx.rfc-ignorant.org is that you cannot use it with FEATURE(dnsbl). So you may need to write your own sendmail ruleset. Like this:

# Normally these should not be defined, since Kdnsbl does exactly what
# Kbmx_check does, and Kmacro does what Kbmx_macro does.
Kbmx_check dns -R A -a.FOUND -T.TMP
Kbmx_macro macro

R$*			$: $>canonify $1
R$* < @ $+ . > $*	$1 < @ $2 > $3
R$* < @ $+ > $*		$: $2
R$*			$: $(bmx_macro {Bmx} $@ $1 $) $1
# The next line is broken in two for readability
R$*			$: $(bmx_check $&{Bmx}.bogusmx.rfc-ignorant.org. $: $1.NOTFOUND $)
# The next line is broken in two for readability
R$* . FOUND		$#error $@ 5.7.1 $: Mail from $&{Bmx} refused.It is listed in bogusmx.rfc-ignorant.org.

You can grab the above sendmail code fragment from here. Always be careful if copy-pasting because sendmail uses tabs and not spaces to distinguish between LHS and RHS.

An alternative on how to use domain based blacklist zones is shown by RFCI here (and also has pointers for mail servers other than sendmail).


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: