Is there a command line utility that checks if a specified mailserver is on some well-known blacklist?
I know amispammer but it is only available on Debian, it seems to be unmaintained and last time I checked it was very memory hungry.
$ ./check-dnsbl.py 188.8.131.52 2016-11-05 19:01:13 - ERROR - There is no reverse DNS record for 184.108.40.206 2016-11-05 19:01:13 - ERROR - OMG, 220.127.116.11 is listed in DNSBL zen.spamhaus.org: 127.0.0.11 ("https://www.spamhaus.org/query/ip/18.104.22.168") 2016-11-05 19:01:19 - ERROR - OMG, 22.214.171.124 is listed in DNSBL virbl.dnsbl.bit.nl: 127.0.0.2 ("See: http://virbl.bit.nl/lookup/index.php?ip=126.96.36.199") 2016-11-05 19:01:19 - ERROR - 188.8.131.52 is listed in 2 blacklists
--debug switch increases the verbosity, e.g.:
2016-11-05 20:19:21 - DEBUG - Checking 26 DNS blacklists
(the set of blacklists can be changed via options - 2 of the default lists are aggregations)
It is also ok to just specify domain names:
$ ./check-dnsbl.py mailout1.example.org mailout2.example.org
One of the simplest form of checking the presence of the IP address in a known blacklist is doing a DNS query either with
nslookup to an RBL/DNS list; after all is how email servers do it.
Namely several that are still very active, including:
For instance to check if the IP address 184.108.40.206 is on a blacklist, you reverse it and add the reversed IP to one of the above lists.
$ host 220.127.116.11.zen.spamhaus.org. 18.104.22.168.zen.spamhaus.org has address 127.0.0.4 22.214.171.124.zen.spamhaus.org has address 127.0.0.11
If the DNS lookup returns an value (typically the dummy IP address 127.0.0.2), this means that the sender's IP address is on the blacklist.