Is there a command line utility that checks if a specified mailserver is on some well-known blacklist?
I know amispammer but it is only available on Debian, it seems to be unmaintained and last time I checked it was very memory hungry.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
$ ./check-dnsbl.py 184.108.40.206 2016-11-05 19:01:13 - ERROR - There is no reverse DNS record for 220.127.116.11 2016-11-05 19:01:13 - ERROR - OMG, 18.104.22.168 is listed in DNSBL zen.spamhaus.org: 127.0.0.11 ("https://www.spamhaus.org/query/ip/22.214.171.124") 2016-11-05 19:01:19 - ERROR - OMG, 126.96.36.199 is listed in DNSBL virbl.dnsbl.bit.nl: 127.0.0.2 ("See: http://virbl.bit.nl/lookup/index.php?ip=188.8.131.52") 2016-11-05 19:01:19 - ERROR - 184.108.40.206 is listed in 2 blacklists
--debug switch increases the verbosity, e.g.:
2016-11-05 20:19:21 - DEBUG - Checking 26 DNS blacklists
(the set of blacklists can be changed via options - 2 of the default lists are aggregations)
It is also ok to just specify domain names:
$ ./check-dnsbl.py mailout1.example.org mailout2.example.org
One of the simplest form of checking the presence of the IP address in a known blacklist is doing a DNS query either with
nslookup to an RBL/DNS list; after all is how email servers do it.
Namely several that are still very active, including:
For instance to check if the IP address 220.127.116.11 is on a blacklist, you reverse it and add the reversed IP to one of the above lists.
$ host 18.104.22.168.zen.spamhaus.org. 22.214.171.124.zen.spamhaus.org has address 127.0.0.4 126.96.36.199.zen.spamhaus.org has address 127.0.0.11
If the DNS lookup returns an value (typically the dummy IP address 127.0.0.2), this means that the sender's IP address is on the blacklist.