DNSBL is enabled but does not work

[ChananZ]

Greetings,

Our Linux server had worked fine until a few days ago. Then the Dr. Web license was not renewed automatically for some reason, and also the spam protection using zen.spamhaus.org has stopped working.

Now we're receiving tons of incoming spam that does not get filtered by spamhaus.org's DNSBL.

The license for Dr. Web has been installed now manually.
Yet no matter what we do through the Plesk Panel, we can't seem to be able to enable the spamhaus.org filtering.

Plesk 8.3.0.
SpamAssassin is active.
Dr. Web is active.

Any clue?

 

[Faris Raouf]

can you post your /etc/xinetd.d/smtp_psa file please? (or wherever your OS puts it)

That might provide a clue as to what is happening.

Faris.

 

[ChananZ]

Thanks for responding.
Problem is still there, most probably thanks to the Dr. Web component.

Here's the smtp_psa file:
------------------------------------
service smtp
{
socket_type = stream
protocol = tcp
wait = no
disable = no
user = root
instances = UNLIMITED
server = /var/qmail/bin/tcp-env
server_args = -Rt0 /usr/sbin/rblsmtpd -r zen.spamhaus.org /var/qmail/bin/relaylock /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
}
-------------------------------------

Thanks.

 

[Faris Raouf]

As I understand things, the dnsbl check happens before any virus checking, so even if Dr Web wasn't working correctly I'd still expect the dnsbl side of things to work. Obviously this is not the case here though and something more serious must be afoot, so I'm not sure what to suggest other than maybe a manual check to see if you can do a DNS lookup using zen.spamhaus.org

If I remember correctly, you basically need to do a lookup for the reverse of the IP.

e.g. to lookup 1.2.3.4 you'd need to do ab nslookup or dig on 4.3.2.1.zen.spamhaus.org
(I could be wrong about this though)

Faris.

 

[ChananZ]

A good point.
I've looked up an IP address that should have been blocked:
Looking up with
- zen.spamhaus.org return not found.
- sbl.spamhaus.org returned not found.
- xbl.spamhaus.org caught the offending IP address.

Strange, as zen is said to include xbl.

But, I've changed my rbl settings and now all is fine.

Thanks a lot for this tip.