Question Email Security config-check.php queries the defunct DNSBL list.dsbl.org every day

[Fabian]

Server operating system version

Ubuntu 26.04

Plesk version and microupdate number

Plesk Obsidian 18.0.81.4

hi,

on Plesk Obsidian 18.0.81.4 (Ubuntu 26.04) I noticed a daily DNS error in my local resolver (Unbound) at 18:18:

SERVFAIL <x.x.x.x.list.dsbl.org. A IN>: all servers for this domain failed, upstream server timeout

The queried name is the reversed IP of my own server. It matches the cron job of the Email Security extension (18 18 * * *, user psaadm):

/opt/psa/admin/bin/php -dauto_prepend_file=sdk.php '/opt/psa/admin/plib/modules/email-security/scripts/config-check.php'

To confirm, I ran the script manually as psaadm. About 15 seconds later the same SERVFAIL for list.dsbl.org appeared in Unbound’s log. The script itself finishes normally (exit code 0).

The DSBL blocklist was shut down many years ago, so this lookup can only time out. It is harmless for me, but it looks like an outdated entry in the list of DNSBLs that the check uses. I could not find the string in the extension’s readable files, so it is probably loaded from somewhere else.

Could you please check whether list.dsbl.org can be removed from that list?


Thanks!

 

[tessa67]

Hey,

probably an outdated entry in the DNSBL list the extension checks (DSBL has been dead for years, so the lookup can only time out). Since the string isn't in the readable files, it may sit in a compiled/encoded file or the database.

You could try to find it:

grep -rl "dsbl" /opt/psa/admin/plib/modules/email-security/ /usr/local/psa/ 2>/dev/null

Also check Tools & Settings > Mail Server Settings and see if list.dsbl.org is in the DNSBL zones there. If it is, just remove it.

If it's not there, it needs a fix from Plesk, so I'd open a ticket and mention the cron job (config-check.php) and the SERVFAIL for list.dsbl.org.

Until then you can silence it in Unbound by answering the dead zone locally:

server:   
    local-zone: "list.dsbl.org." always_nxdomain

Then reload Unbound:

unbound-checkconf
unbound-control reload

Regards
Tessa