URILocalBL

This plugin requires the Perl Module GeoIP2::Database::Reader.

This plugin blocklists URIs using local information (ISP names, address lists, and country codes) looked up in a local GeoIP2 database, instead of querying DNS blocklists. It creates some new rule test types, such as uri_block_cc, uri_block_cont and uri_block_cidr. These rules apply to the URIs found in the HTML portion of a message, i.e. <a href=...> markup.

Why local blocklisting? There are a few excellent, effective, and well-maintained DNSBLs out there. But they have several drawbacks:

  1. blocklists can cover tens of thousands of entries, and you can't select which ones you use
  2. verifying that it's correctly configured can be non-trivial.
  3. New blocklisting entries may take a while to be detected and entered, so it's not instantaneous.

Sometimes all you want is a quick, easy, and very surgical blocklisting of a particular site or a particular ISP. This plugin is defined for that exact usage case.

How it works

Warden enables the Mail::SpamAssassin::Plugin::URILocalBL plugin in SpamAssassin. The rules apply to the URIs found in the HTML portion of a message: the location of each URI is looked up in the local GeoIP2 database, and the following settings define what to block:

  • urilocalbl_bad_country - block URIs pointing to the listed countries
  • urilocalbl_bad_continent - block URIs pointing to the listed continents
  • urilocalbl_bad_cidr - block URIs pointing to the listed CIDR blocks
  • urilocalbl_bad_exclude - exempt specific hosts from being blocked

Rules

Area Rule name Description Default scores
body URILOCALBL_BAD_COUNTRY Contains an URL from a bad country 3.25
body URILOCALBL_BAD_CONTINENT Contains an URL from a bad continent 3.25
body URILOCALBL_BAD_CIDR Contains an URL from a bad CIDR 3.25
body URILOCALBL_BAD_EXCLUDE Contains an URL excluded from blocking 0

Related Pages