# Please don't modify this file as your changes might be overwritten with # the next update. # # You can modify 'local.d/rbl.conf' to add and merge # parameters defined inside this section # # You can modify 'override.d/rbl.conf' to strictly override all # parameters defined inside this section # # See https://rspamd.com/doc/faq.html#what-are-the-locald-and-overrided-directories # for details # # Module documentation can be found at https://rspamd.com/doc/modules/rbl.html rbl { default_from = true; default_received = false; default_exclude_users = true; default_unknown = true; url_whitelist = [ "https://maps.rspamd.com/rspamd/surbl-whitelist.inc.zst", "$LOCAL_CONFDIR/local.d/maps.d/surbl-whitelist.inc.local", "${DBDIR}/surbl-whitelist.inc.local", "fallback+file://${CONFDIR}/maps.d/surbl-whitelist.inc" ]; rbls { spamhaus { symbol = "SPAMHAUS"; # Augmented by prefixes rbl = "zen.spamhaus.org"; ipv6 = true; received = true; from = true; symbols_prefixes = { received = 'RECEIVED', from = 'RBL', } returncodes { SPAMHAUS_SBL = "127.0.0.2"; SPAMHAUS_CSS = "127.0.0.3"; SPAMHAUS_XBL = ["127.0.0.4", "127.0.0.5", "127.0.0.6", "127.0.0.7"]; SPAMHAUS_PBL = ["127.0.0.10", "127.0.0.11"]; SPAMHAUS_DROP = "127.0.0.9"; SPAMHAUS_BLOCKED_OPENRESOLVER = "127.255.255.254"; SPAMHAUS_BLOCKED= "127.255.255.255"; } } mailspike { symbol = "MAILSPIKE"; rbl = "rep.mailspike.net"; is_whitelist = true; whitelist_exception = "MAILSPIKE"; whitelist_exception = "RWL_MAILSPIKE_GOOD"; whitelist_exception = "RWL_MAILSPIKE_NEUTRAL"; whitelist_exception = "RWL_MAILSPIKE_POSSIBLE"; whitelist_exception = "RBL_MAILSPIKE_WORST"; whitelist_exception = "RBL_MAILSPIKE_VERYBAD"; whitelist_exception = "RBL_MAILSPIKE_BAD"; returncodes { RBL_MAILSPIKE_WORST = "127.0.0.10"; RBL_MAILSPIKE_VERYBAD = "127.0.0.11"; RBL_MAILSPIKE_BAD = "127.0.0.12"; RWL_MAILSPIKE_NEUTRAL = ["127.0.0.16", "127.0.0.15", "127.0.0.14", "127.0.0.13"]; RWL_MAILSPIKE_POSSIBLE = "127.0.0.17"; RWL_MAILSPIKE_GOOD = "127.0.0.18"; RWL_MAILSPIKE_VERYGOOD = "127.0.0.19"; RWL_MAILSPIKE_EXCELLENT = "127.0.0.20"; } } senderscore { symbol = "RBL_SENDERSCORE"; rbl = "bl.score.senderscore.com"; } sem { symbol = "RBL_SEM"; rbl = "bl.spameatingmonkey.net"; ipv6 = false; } semIPv6 { symbol = "RBL_SEM_IPV6"; rbl = "bl.ipv6.spameatingmonkey.net"; ipv4 = false; ipv6 = true; } dnswl { symbol = "RCVD_IN_DNSWL"; rbl = "list.dnswl.org"; ipv6 = true; is_whitelist = true; whitelist_exception = "RCVD_IN_DNSWL"; whitelist_exception = "RCVD_IN_DNSWL_NONE"; whitelist_exception = "RCVD_IN_DNSWL_LOW"; whitelist_exception = "DNSWL_BLOCKED"; returncodes { RCVD_IN_DNSWL_NONE = "127.0.%d+.0"; RCVD_IN_DNSWL_LOW = "127.0.%d+.1"; RCVD_IN_DNSWL_MED = "127.0.%d+.2"; RCVD_IN_DNSWL_HI = "127.0.%d+.3"; DNSWL_BLOCKED = "127.0.0.255"; } } # Provided by https://virusfree.cz virusfree { symbol = "RBL_VIRUSFREE_UNKNOWN"; rbl = "bip.virusfree.cz"; ipv6 = true; returncodes { RBL_VIRUSFREE_BOTNET = "127.0.0.2"; } } nixspam { symbol = "RBL_NIXSPAM"; rbl = "ix.dnsbl.manitu.net"; ipv6 = true; } blocklistde { symbols_prefixes = { received = 'RECEIVED', from = 'RBL', } symbol = "BLOCKLISTDE"; rbl = "bl.blocklist.de"; ipv6 = true; received = true; from = true; } dnswl_dwl { symbol = "DWL_DNSWL"; rbl = "dwl.dnswl.org"; dkim = true; dkim_domainonly = false; dkim_match_from = true; ignore_whitelist = true; unknown = false; returncodes { DWL_DNSWL_NONE = "127.0.%d+.0"; DWL_DNSWL_LOW = "127.0.%d+.1"; DWL_DNSWL_MED = "127.0.%d+.2"; DWL_DNSWL_HI = "127.0.%d+.3"; DWL_DNSWL_BLOCKED = "127.0.0.255"; } } # Old emails module RSPAMD_EMAILBL { ignore_defaults = true; emails_delimiter = "."; hash_format = "base32"; hash_len = 32; rbl = "email.rspamd.com"; replyto = true; hash = "blake2"; returncodes = { RSPAMD_EMAILBL = "127.0.0.2"; } } MSBL_EBL { ignore_defaults = true; rbl = "ebl.msbl.org"; emails_domainonly = false; replyto = true; hash = "sha1"; returncodes = { MSBL_EBL = [ "127.0.0.2", "127.0.0.3" ]; MSBL_EBL_GREY = [ "127.0.1.2", "127.0.1.3" ]; } } # Old SURBL module "SURBL_MULTI" { ignore_defaults = true; rbl = "multi.surbl.org"; dkim = true; emails = true; emails_domainonly = true; urls = true; returnbits = { CRACKED_SURBL = 128; # From February 2016 ABUSE_SURBL = 64; MW_SURBL_MULTI = 16; PH_SURBL_MULTI = 8; SURBL_BLOCKED = 1; } } "URIBL_MULTI" { ignore_defaults = true; rbl = "multi.uribl.com"; dkim = true; emails = true; emails_domainonly = true; urls = true; returnbits { URIBL_BLOCKED = 1; URIBL_BLACK = 2; URIBL_GREY = 4; URIBL_RED = 8; } } "RSPAMD_URIBL" { ignore_defaults = true; rbl = "uribl.rspamd.com"; dkim = true; emails = true; emails_domainonly = true; urls = true; hash = 'blake2'; hash_len = 32; hash_format = 'base32'; returncodes = { RSPAMD_URIBL = [ "127.0.0.2", ]; } } "DBL" { ignore_defaults = true; rbl = "dbl.spamhaus.org"; no_ip = true; dkim = true; emails = true; emails_domainonly = true; urls = true; returncodes = { # spam domain DBL_SPAM = "127.0.1.2"; # phish domain DBL_PHISH = "127.0.1.4"; # malware domain DBL_MALWARE = "127.0.1.5"; # botnet C&C domain DBL_BOTNET = "127.0.1.6"; # abused legit spam DBL_ABUSE = "127.0.1.102"; # abused spammed redirector domain DBL_ABUSE_REDIR = "127.0.1.103"; # abused legit phish DBL_ABUSE_PHISH = "127.0.1.104"; # abused legit malware DBL_ABUSE_MALWARE = "127.0.1.105"; # abused legit botnet C&C DBL_ABUSE_BOTNET = "127.0.1.106"; # error - IP queries prohibited! DBL_PROHIBIT = "127.0.1.255"; # issue #3074 DBL_BLOCKED_OPENRESOLVER = "127.255.255.254"; DBL_BLOCKED = "127.255.255.255"; } } # Not enabled by default due to privacy concerns! (see also groups.d/surbl_group.conf) #"SPAMHAUS_ZEN_URIBL" { # suffix = "zen.spamhaus.org"; # resolve_ip = true; # check_emails = true; # ips { # URIBL_SBL = "127.0.0.2"; # URIBL_SBL_CSS = "127.0.0.3"; # URIBL_XBL = ["127.0.0.4", "127.0.0.5", "127.0.0.6", "127.0.0.7"]; # URIBL_PBL = ["127.0.0.10", "127.0.0.11"]; # URIBL_DROP = "127.0.0.9"; # } #} "SEM_URIBL_UNKNOWN" { ignore_defaults = true; rbl = "uribl.spameatingmonkey.net"; no_ip = true; dkim = true; emails = true; emails_domainonly = true; urls = true; returnbits { SEM_URIBL = 2; } } "SEM_URIBL_FRESH15_UNKNOWN" { ignore_defaults = true; rbl = "fresh15.spameatingmonkey.net"; no_ip = true; dkim = true; emails = true; emails_domainonly = true; urls = true; returnbits { SEM_URIBL_FRESH15 = 2; } } # Proved to be broken #"RBL_SARBL_BAD" { # suffix = "public.sarbl.org"; # noip = true; # images = true; #} } .include(try=true,priority=5) "${DBDIR}/dynamic/rbl.conf" .include(try=true,priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/rbl.conf" .include(try=true,priority=10) "$LOCAL_CONFDIR/override.d/rbl.conf" }