--- title: 'Network Settings' url: 'https://docs.danami.com/warden/settings/antispam/network-settings' markdown: 'https://docs.danami.com/warden/settings/antispam/network-settings.md' date: '2026-10-09' description: 'Network Settings Trusted networks - trusted_networks What networks or hosts are "trusted" in your setup. Trusted in this case means that relay hosts on these networks are considered to not be potentially operated by spammers, open relays, or open proxies. A trusted host could conceivably relay spam…' taxonomy: category: - docs tag: - network --- [](#) [ Basics ](https://docs.danami.com/warden/) [ Settings ](https://docs.danami.com/warden/settings) [ Antispam ](https://docs.danami.com/warden/settings/antispam) Network Settings # Network Settings ## Network Settings **Trusted networks** - `trusted_networks` What networks or hosts are "trusted" in your setup. Trusted in this case means that relay hosts on these networks are considered to not be potentially operated by spammers, open relays, or open proxies. A trusted host could conceivably relay spam, but will not originate it, and will not forge header data. DNS blacklist checks will never query for hosts on these networks. Default: empty **Internal networks** - `internal_networks` What networks or hosts are "internal" in your setup. Internal means that relay hosts on these networks are considered to be MXes for your domain(s), or internal relays. This uses the same syntax as trusted\_networks, above - see there for details. Default: empty **Originating IP headers** - `originating_ip_headers` A list of header field names from which an originating IP address can be obtained. For example, webmail servers may record a client IP address in X-Originating-IP. These IP addresses are virtually appended into the Received: chain, so they are used in RBL checks where appropriate. Default: empty ## DNS Settings **DNS available** - `dns_available` Tells SpamAssassin whether DNS resolving is available or not. A value yes indicates DNS resolving is available, a value no indicates DNS resolving is not available - both of these values apply unconditionally and skip initial DNS tests, which can be slow or unreliable. Default: 1 **DNS servers** - `dns_server` Specifies an IP address of a DNS server, and optionally its port number. The *ip-addr-port* port argument can either be an IPv4 or IPv6 address, optionally enclosed in brackets, and optionally followed by a colon and a port number. In absence of a port number a standard port number 53 is assumed. When an IPv6 address is specified along with a port number, the address must be enclosed in brackets to avoid parsing ambiguity regarding a colon separator. This option was introduced in Spamassassin 3.4. Default: empty **DNS query restrictions** - `dns_query_restriction` Allows disabling of rules which would result in a DNS query to one of the listed domains. The first argument must be a literal `allow` or `deny`, the remaining arguments are domain names. Most DNS queries (with some exceptions) are subject to dns\_query\_restriction. A domain to be queried is successively stripped of its leading labels (yielding a series of its parent domains), and on each iteration a check is made against the entries generated by `dns_query_restriction`. The search stops at the first match (i.e. the tightest match), and the matching entry with its `allow` or `deny` value then controls whether a DNS query is allowed to be launched. If no match is found the implicit default is to allow a query. An explicit `allow` entry can override a previously configured `deny` on the same domain or on one of its parent domains. Domains are matched case-insensitively, no wildcards are recognized, and there should be no leading or trailing dot. The special wildcard `deny *` is supported to block all queries except allowed ones. Default: empty **Skip RBL checks** - `skip_rbl_checks` Turning on the skip\_rbl\_checks setting will disable the DNSEval plugin, which implements Real-time Block List (or: Blackhole List) (RBL) lookups. By default, SpamAssassin will run RBL checks. Individual blocklists may be disabled selectively by setting a score of a corresponding rule to 0. Default: 0 **RBL timeout** - `rbl_timeout` All DNS queries are made at the beginning of a check and we try to read the results at the end. This value specifies the maximum period of time (in seconds) to wait for a DNS query. If most of the DNS queries have succeeded for a particular message, then SpamAssassin will not wait for the full period to avoid wasting time on unresponsive server(s), but will shrink the timeout according to a percentage of queries already completed. As the number of queries remaining approaches 0, the timeout value will gradually approach a t\_min value, which is an optional second parameter and defaults to 0.2 \* t. If t is smaller than t\_min, the initial timeout is set to t\_min. Default: 15 [ ](https://docs.danami.com/warden/command-line-interface/antispam/antispam-network) --- ## Navigation - Parent: [Antispam](https://docs.danami.com/warden/settings/antispam.md) - Previous: [Learning Settings](https://docs.danami.com/warden/settings/antispam/learning-settings.md) - Next: [Training Settings](https://docs.danami.com/warden/settings/antispam/training-settings.md)