plugin-check-dnsbl.so

A mailfront plugin to provide IPv4/IPv6 DNSBL/DNSWL checking of sender's
IP address and to defer, reject or accept mails based on its check.  This
plugin will add its checking results to each mail message header for all
mails accepted depending on environment variables configurations.

(1).  If $DNSBL_CHECK_SKIP is set, this plugin will be skipped.

(2).  If $RELAYCLIENT is set, add to message header and skip the remaining
      checks.  Example of message header added:

      X-DNSBL-Check-Result: SKIPPED: $RELAYCLIENT is set for 1.2.3.4

(3).  If sender is authenticated, add to message header and skip the
      remaining checks.  Example of message header added:

      X-DNSBL-Check-Result: SKIPPED: authenticated user from 1.2.3.4

(4).  If $RBLSMTPD is set and empty, add to message header and skip the
      remaining checks.  If $RBLSMTPD is set and not empty, the reply code
      is set to 553 if the first character of $RBLSMTPD is "-" otherwise
      the reply code is set to 451.  The reply message will be copied from
      $RBLSMTPD and will skip "-" if it is the starting character of
      $RBLSMTPD.  Examples of smtp.rules for tcprules:

      1.1.1.1:allow,RBLSMTPD=""
      2.2.2.2:allow,RBLSMTPD="-Your IP is listed in our denied list."
      3.3.3.3:allow,RBLSMTPD="Your IP is listed in our denied list."

      The above will cause this plugin to accept mails from IP 1.1.1.1,
      reject mails from IP 2.2.2.2 and defer mails from IP 3.3.3.3.  Below
      are the reply to sender's IP 2.2.2.2 and 3.3.3.3 respectively:

      553 Your IP is listed in our denied list.
      451 Your IP is listed in our denied list.

      Example of message header added for IP 1.1.1.1:

      X-DNSBL-Check-Result: SKIPPED: $RBLSMTPD is set and empty for 1.1.1.1

(5).  $RWLDOMAINS is the list of IPv4 servers/domains and $RWLDOMAINS_IPV6
      is the list of IPv6 servers/domains to check for whitelisting (DNSWL).
      Each domain needs to be seperated with a space or a comma.

      If $RWLDOMAINS is set and not empty, the domains listed will be used
      for IPv4 DNSWL checking.  Likewise for $RWLDOMAINS_IPV6 is for IPv6
      DNSWL checking.

(6).  $RWLDOMAINSFILE is a file with list of IPv4 servers/domains and
      $RWLDOMAINSFILE_IPV6 is a file with list of IPv6 servers/domains to
      check for whitelisting (DNSWL).

      Format is one domain per line. Lines started with # are ignored.

      NOTE: $RWLDOMAINSFILE file contents will be copied to $RWLDOMAINS
      if is not set or empty.  Likewise for $RWLDOMAINSFILE_IPV6 file contents
      will be copied to $RWLDOMAINS_IPV6 if is not set or empty.
      
      If $RWLDOMAINSFILE not set will default to
      /var/qmail/control/rwldomains and $RWLDOMAINSFILE_IPV6 default to
      /var/qmail/control/rwldomains6.

(7).  $RBLDOMAINS is the list of IPv4 servers/domains and $RBLDOMAINS_IPV6
      is the list of IPv6 servers/domains to check for blacklisting (DNSBL).
      Each domain needs to be seperated with a space or a comma.

      If $RBLDOMAINS is set and not empty, the domains listed will be used
      for IPv4 DNSBL checking.  Likewise for $RBLDOMAINS_IPV6 is for IPv6
      DNSBL checking.

(8).  $RBLDOMAINSFILE is a file with list of IPv4 servers/domains and
      $RBLDOMAINSFILE_IPV6 is a file with list of IPv6 servers/domains to
      check for blacklisting (DNSBL).

      Format is one domain per line. Lines started with # are ignored.

      NOTE: $RBLDOMAINSFILE file contents will be copied to $RBLDOMAINS
      if is not set or empty.  Likewise for $RBLDOMAINSFILE_IPV6 file contents
      will be copied to $RBLDOMAINS_IPV6 if is not set or empty.
      
      If $RBLDOMAINSFILE not set will default to
      /var/qmail/control/rbldomains and $RBLDOMAINSFILE_IPV6 default to
      /var/qmail/control/rbldomains6.

(9).  If $RWLDOMAINS and $RBLDOMAINS not set or empty, add to mail
      message header and skip the IPv4 DNSWL/DNSBL checks.  Example of mail
      header added:

      X-DNSBL-Check-Result: SKIPPED: $RWLDOMAINS and $RBLDOMAINS not set or empty for 1.2.3.4
      
      If $RWLDOMAINS_IPV6 and $RBLDOMAINS_IPV6 not set or empty, add to mail
      message header and skip the IPv6 DNSWL/DNSBL checks.  Example of mail
      header added:

      X-DNSBL-Check-Result: SKIPPED: $RWLDOMAINS_IPV6 and $RBLDOMAINS_IPV6 not set or empty for 1100:2200:3300::4

(10). If $DNSBL_CHECK_REJECT is set, sender will be rejected with reply
      code 553 if sender's IP is listed in one of the $RBLDOMAINS domain.
      If sender's IP is listed in one of the $RWLDOMAINS domains, mail
      message will be accepted as this plugin take preference of
      $RWLDOMAINS domains then $RBLDOMAINS domains.

(11). If $DNSBL_CHECK_DEFER is set, sender will be rejected with reply
      code 451 if sender's IP is listed in one of the $RBLDOMAINS domain.
      If sender's IP is listed in one of the $RWLDOMAINS domains, mail
      message will be accepted as this plugin take preference of
      $RWLDOMAINS domains then $RBLDOMAINS domains.
      NOTE: $DNSBL_CHECK_REJECT take preference of $DNSBL_CHECK_DEFER.

NOTE: For (10) and (11), mails that are rejected/deferred due to blacklist,
      this plugin will use the first listed domain's TXT record in its
      reply message.  If there isn't such will default to the following:

      Sorry, your ip ${PROTO}REMOTEIP is listed in one or more of the DNSBL: $RBLDOMAINS

      The ${PROTO}REMOTEIP and $RBLDOMAINS will be parsed accordingly.

      If sender's IP is listed in one of the $RWLDOMAINS domain, instead of
      rejecting/deferring mail, mail message will be accepted and all the
      DNSWL/DNSBL check results will be added to each mail message header.

(12). If $DNSBL_CHECK_REJECT and $DNSBL_CHECK_DEFER not set, all mail
      message will be accepted with DNSWL/DNSBL check results added to each
      mail message header.

(13). If $DNSBL_CHECK_VERBOSE is set, this plugin will log its checking to
      stderr.


Requirements:

- mailfront version 2.00 or later (might work with earlier version)
- bglibs version 1.104 or later (might work with earlier version)
- libowfat (http://www.fefe.de/libowfat/)

Installation:

- Build and install mailfront
- Switch back to this package
- Adjust the contents of the conf-* files
- Build the sources by running "make"
- Install the plugin by running "make install"

Configuration:

Place check-dnsbl in mailfront's plugin list. Depending on your setup
- edit the smtpfront-qmail shell script and place the string "check-dnsbl"
  after "add-received"
- edit the PLUGINS environment variable and place the string "check-dnsbl"
  after "add-received"
- place the argument "rblcheck" after the "add-received" of the
  mailfront command

Set up environment as described in plugin-check-dnsbl.html.


This package is Copyright(C) 2013 Giam Teck Choon or CHOON.NET,
and may be copied according to the GNU GENERAL PUBLIC LICENSE (GPL)
Version 2 or a later version.  A copy of this license is included with
this package.  This package comes with no warranty of any kind.
