Do not use free public DNS servers like Google DNS, OpenDNS or Level3 for nameservers in your server's
/etc/resolv.confwhen using this plugin. We recommend using a caching DNS server locally.
This plugin works by analysing message text and HTML for URLs, extracting host names from those, then querying various DNS blocklists for either: IP addresses of these hosts (uridnsbl,a) or their nameservers (uridnsbl,ns), or domain names of these hosts (urirhsbl), or domain names of their nameservers (urinsrhsbl, urifullnsrhsbl).
Warden enables the Mail::SpamAssassin::Plugin::URIDNSBL plugin in SpamAssassin. It extracts the host names from the URLs found in the message text and HTML, and queries the configured DNS blocklists with either the IP addresses of those hosts (rules with tflag a), the IP addresses of their nameservers (tflag ns), the domain names themselves (RHSBL-style urirhsbl), or the nameserver domain names (urinsrhsbl / urifullnsrhsbl).
Well-known domains that are not going to be listed can be excluded from the lookups with uridnsbl_skip_domain (the number of domains looked up is limited by uridnsbl_max_domains), and the plugin can be disabled entirely with skip_uribl_checks.
When a rule lists four scores: the first applies when neither the Bayesian classifier nor network tests are in use, the second when only network tests are in use, the third when only the Bayesian classifier is in use and the fourth when both are in use.
| Area | Rule name | Description | Default scores |
|---|---|---|---|
| body | URIBL_DM_SURBL |
Contains an URL listed in the DM SURBL blocklist | -- |
| body | URIBL_CT_SURBL |
Contains an URL listed in the CT SURBL blocklist | -- |
| body | URIBL_PH_SURBL |
Contains an URL listed in the PH SURBL blocklist | 0 0.001 0 0.610 |
| body | URIBL_MW_SURBL |
Contains a URL listed in the MW SURBL blocklist | 0 1.263 0 1.263 |
| body | URIBL_CR_SURBL |
Contains an URL listed in the CR SURBL blocklist | 0 1.263 0 1.263 |
| body | URIBL_ABUSE_SURBL |
Contains an URL listed in the ABUSE SURBL blocklist | 0 1.948 0 1.250 |
| body | URIBL_BLACK |
Contains an URL listed in the URIBL blacklist | 0 1.7 0 1.7 |
| body | URIBL_GREY |
Contains an URL listed in the URIBL greylist | 0 1.084 0 0.424 |
| body | URIBL_RED |
Contains an URL listed in the URIBL redlist | 0 0.001 0 0.001 |
The URIDNSBL plugin adds the following tags that are available for use in reports, header fields, and other plugins:
| Tag | Description |
|---|---|
_URIHOSTS_ |
Hosts extracted from URIs |
_URIDOMAINS_ |
Domains extracted from URIs |
_URICNAMES_ |
DNS CNAMEs of hosts extracted from URIs |