A very long time ago, I used to collect spam in order to graph how much spam a single mail server was likely to get over time, and almost as long ago, I lost interest in maintaining it. As a consequence I still get a ton of spam every day and after a long period of procrastination I have been slowly raising defences against spam.
This particular recipe is not really a defence against spam – it verifies that the remote server is properly DNS registered with a reverse DNS registration – in other words that the IP address it is connecting from is registered. This is a requirement for all mail servers, and as it turns out, spammers don’t care for registering their servers in the DNS.
This ACL snippet goes into the ACL for checking the recipient or for checking the message :-
deny
message = Your mail server is not properly DNS registered
log_message = BLOCKED: No rDNS
condition = ${if eq{$host_lookup_failed} {1} {1}{0}}
# Check rDNS and block if not registered
There are three items of interest :-
- The message is intended to be easily read by recipients to determine what the problem is. It turns out that many people do not read NDRs, but if we get the message right at least we are doing the right thing.
- The log_message is intended to make automating log parsing easier.
- Within the condition, the $host_lookup_failed variable indicates that the reverse DNS lookup returned NXDOMAIN and not that it timed out (which would be $host_lookup_deferred).
That’s all there is to this little piece of configuration.
