0

Is there a command line utility that checks if a specified mailserver is on some well-known blacklist?

I know amispammer but it is only available on Debian, it seems to be unmaintained and last time I checked it was very memory hungry.

  • Use the host command. – Ipor Sircer Nov 1 '16 at 19:57
  • And not only very memory hungry, 46 dependencies to install? (...) – Rui F Ribeiro Nov 1 '16 at 20:22
  • @IporSircer, for the occasional check of one IP address against one DNSBL manually reversing the address, concatenating it with the hostname of the list and querying the result with host or better dig is ok. But amispammer automates the querying of many lists. – maxschlepzig Nov 5 '16 at 19:35
  • 1
    @RuiFRibeiro, it's crazy, right? I've created a small Python 3 script that has just one dependency ... (cf. my answer). – maxschlepzig Nov 5 '16 at 19:38
  • That is one of the ways of doing it... I usually do more that kind of stuff in bash, have to use python more. – Rui F Ribeiro Nov 5 '16 at 19:42
2

Since I didn't find an amispammer substitute I created check-dnsbl.py, a small Python script that checks some well-known blacklists. It uses dnspython for all the necessary DNS requests.

Example:

$ ./check-dnsbl.py 117.246.201.146     
2016-11-05 19:01:13 - ERROR    - There is no reverse DNS record for 117.246.201.146
2016-11-05 19:01:13 - ERROR    - OMG, 117.246.201.146 is listed in DNSBL zen.spamhaus.org: 127.0.0.11 ("https://www.spamhaus.org/query/ip/117.246.201.146")
2016-11-05 19:01:19 - ERROR    - OMG, 117.246.201.146 is listed in DNSBL virbl.dnsbl.bit.nl: 127.0.0.2 ("See: http://virbl.bit.nl/lookup/index.php?ip=117.246.201.146")
2016-11-05 19:01:19 - ERROR    - 117.246.201.146 is listed in 2 blacklists

The --debug switch increases the verbosity, e.g.:

2016-11-05 20:19:21 - DEBUG    - Checking 26 DNS blacklists

(the set of blacklists can be changed via options - 2 of the default lists are aggregations)

It is also ok to just specify domain names:

$ ./check-dnsbl.py mailout1.example.org mailout2.example.org
  • When I ran an ISP I wrote once something similar running as an web page to cut down on the email tickets the helpdesk people escalated up. – Rui F Ribeiro Nov 5 '16 at 19:52
2

One of the simplest form of checking the presence of the IP address in a known blacklist is doing a DNS query either with dig, host or nslookup to an RBL/DNS list; after all is how email servers do it.

Namely several that are still very active, including:

  • zen.spamhaus.org
  • bl.spamcop.net
  • cbl.abuseat.org

For instance to check if the IP address 116.103.227.39 is on a blacklist, you reverse it and add the reversed IP to one of the above lists.

$ host 39.227.103.116.zen.spamhaus.org.
39.227.103.116.zen.spamhaus.org has address 127.0.0.4
39.227.103.116.zen.spamhaus.org has address 127.0.0.11

From DNS Blacklist (DNSBL / RBL) plug-in

If the DNS lookup returns an value (typically the dummy IP address 127.0.0.2), this means that the sender's IP address is on the blacklist.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.