Tag Archives: rbls

How Do RBLs Affect Me? (Part 3)

sbOriginally posted on RBLTracker

In Part 1 and Part 2 of our series, I talked about what RBLs are, how they work, and how RBLs are used by administrators to control the day-to-day onslaught of SPAM on their email systems. In this article I’m going to talk about how RBLs affect you, your business, and why you should care.

So Why Do I Care?

Getting listed on an RBL or URIBL is not uncommon- it happens.

  • Maybe you have a customer using your email platform that didn’t quite understand the rules against bulk email.
  • Maybe one of your employees downloaded some virus infested software that started sending SPAM to all the contacts in their email client.
  • Maybe your email administrator made a mistake when configuring your email system, and opened you up as an open relay.
  • Maybe the WordPress or Drupal installation on your website was compromised, and injected with phishing code.

We all do our best to ensure that these types of errors aren’t the norm, but human error happens.

As a mail recipient, RBLs protect you from these issues by rejecting these messages before they land in your inbox. As a mail sender, RBLs protect others FROM your issues- and limit your overall liability, by reducing the number of messages delivered.

By listing compromised mail servers and website domains, and using these RBLs and URIBLs in our mail systems, we effectively limit the spread of SPAM and phishing websites, which is good for everybody.

Sounds Great- What’s the Catch?

Once you’re listed- as the name indicates- you’re “black-holed”- much of your email won’t be reaching its destination, and traffic to your websites could be limited.

If your business relies on email communication- either as a tool, or a product- then the longer you’re listed, the worst it is for your bottom line, and your reputation. It looks really bad if your customers email you, and get a bounce message indicating that your email system has been blocked.

The sooner you know there is an issue, the sooner the issue can be resolved, and the sooner you can request delisting from the RBLs in question.

RBLTracker

RBLTracker provides a fully automated RBL monitoring service, which checks your IP addresses and website domains, against a customizable list of the top DNSBLs, and will alert you immediately if your system is listed.

Don’t wait days or weeks to find out that your email hasn’t been reaching your customers- click here to find out more!

How Are Blacklists Used? (Part 2)

Originally posted on RBLTracker Blacklist Check Service blog.

In Part 1 of our series we talked about what RBLs are, and the different types of RBLs. In this article, we’ll talk more about how they can be used by administrators to control the flow of SPAM into their networks.

How Are They Used?

Most mail server software can be configured to make requests against DNSBLs, and reject or accept mail, based on if the sending mail servers IP address is listed in the DNSBL. Or in the case of URIBLs, if a domain name or website URL found in the body of the message is listed.

Example

As a quick example, the Exim mail transfer agent (MTA) supports specifying one or more DNSBLs during the ACL processing of an inbound SMTP message.

exim_rbl

Exim will make a DNS lookup request on the sending mail servers’ IP address, and if found in the DNSBL, can reject the message with a specific error message.

The Postfix MTA allows administrator to add one or more DNSBLs using the reject_rbl_client configuration option in the smtpd_recipient_restrictions option.

postfix_rbl

You can also do a simple check on Windows, Mac, and Unix, using the command line nslookup tool. Simply reverse the digits in your IP address, and prefix it to one of the DNSBL host names.

So for example, if your IP address was 127.0.0.2 and you wanted to check the bl.spamcop.net DNSBL, you would do a DNS lookup on: 2.0.0.127.bl.spamcop.net:

manual_lookup

Check back for Part 3 of our series where I talk about how RBLs affect organizations, and why they can be an important part of your day-to-day administration.

What are Blacklists and How Do They Work? (Part 1)

Originally Posted on RBLTracker Blacklist Check Service

Real-Time Blacklists (RBL) are a simple but effective way for organizations around the world, to share the location (in this case, the IP addresses) of email systems that are reputed to send email SPAM.

The most common implementation of these lists are distributed via DNS, and referred to as DNS-based Blacklists (DNSBL). Distributing this data via DNS makes perfect sense; it’s a technology that already exists, and servers all already have access to. It’s fast, and the data (IP addresses and domains) is well suited for DNS.

Types of RBLs

There are hundreds of RBLs available worldwide, managed by hundreds of organizations and individuals. Most RBLs are free to use, some are pay-to-use, and they all have their own methodologies for compiling their databases, and their own processes for being delisted.

Two of the most common and reliable methodologies for collecting data for RBLs, are based on user input, or something they call a “honey pot”.

Crowd Sourced

RBLs based on user input are the most common, and often most reliable. This data is effectively crowd sourced. When an email recipient receives a SPAM message (assuming their system supports it), they can “flag this message as SPAM”. If enough recipients flag the same message as SPAM, the IP address of the sender will be added to the RBL database.

This is common in free email services like Hotmail and Gmail.

Honey Pots

Another common source for RBL data is something called a honey pot. These are basically email addresses that are never used for any legitimate email purposes, and aren’t owned by any end users. They simply exist out on the Internet in places where robots and SPAM aggregators collect email addresses.

Any email that comes to these addresses is by definition unsolicited, and considered SPAM, and will land you on an RBL.

URIBLs

Another type of RBL is the URI Blacklist (URIBL). This is used for distributing domain names of websites that are reputed to send SPAM or to be involved in phishing schemes. So this doesn’t just affect organizations that run their own mail servers, but anyone that has a website as well.

There are definitely RBLs that are more reputable than others; there are some that have no process for being delisted, and others where you have to pay to be delisted. In my opinion, the pay-to-delist RBLs should not be considered reputable, and should not be used by mail system administrators.

Stay tuned for Part 2 of this series, where I’ll talk about how these RBLs are used by organizations, and give you some real-world examples of how RBLs can help you combat SPAM.

RBLTracker: Pushover Notifications and Temporary Manual Hosts

The RBLTracker service was upgraded to v1.13 today, which includes the following new features:

Pushover Notifications

Pushover makes it easy to get real-time notifications on your Android device, iPhone, iPad, and Desktop. Once you have your Pushover client installed, simply copy and paste your user key into the contacts section of the RBLTracker portal.

pushover

Many companies are already using Pushover for system event notifications; this lets you consolidate all your notifications in one simple application.

Temporary Manual Hosts

Customers on the Ultimate package can now add temporary hosts from the Manual Check section of the web portal.

manual_host

 

These temporary hosts will persist for the life of your session, and will disappear as soon as you log out. This feature is handy for customers that would like to do a quick check on a host not currently listed in your host list.

RBLTracker: Custom RBLs, Yandex Safe Browsing, and More

This evening, we’ve released a new version of the RBLTracker service, which includes all sorts of new features, including:

Custom RBLs

The custom RBL feature lets you add custom RBLs and URIBLs to your account, which RBLTracker does not normally check.

custom_rbls

If you have a paid or in-house RBL that you’d like to use, you can add it here, and centralize your monitoring with RBLTracker, and take advantage of our automated checks, and alerting functionality.

Yandex Safe Browsing Support

RBLTracker now has support to monitor the Yandex Safe Browsing database, alongside the Google Safe Browsing database.

yandex_support

The Google and Yandex Safe Browsing databases include lists of website domains that may be dangerous to visitors, because they are suspected of phishing or malware.

The Google Safe Browsing service is already built-in to both the Chrome and Firefox web browsers, the two most popular web browsers on the internet. If your website is compromised because of an outdated WordPress or Drupal installation, your visitors will receive a warning, telling them that YOUR website is dangerous and should be avoided.

A full list of changes included in this release are available below. Any questions or comments, please let us know @ info@rbltracker.com

 

Release version 1.11

  • Added support for monitoring the Yandex Safe Browsing database.
  • Added support for custom RBLs and URIBLs that the RBLTracker system does not normally monitor, for example, paid or internal RBLs.
  • Added support to download invoices from the billing section of the portal. Customers can also add more detailed billing information through the Profile section of the web portal.
  • Added additional pricing options for customers with more than 1000, 2500, and 5000 hosts using the Ultimate package.
  • Added an option for customers to delete their accounts.