URIDNSBL - look up URLs against DNS blocklists
This works by analysing message text and HTML for URLs, extracting the domain names from those, querying their NS records in DNS, resolving the hostnames used therein, and querying various DNS blocklists for those IP addresses. This is quite effective.
loadplugin Mail::SpamAssassin::Plugin::URIDNSBL uridnsbl URIBL_SBLXBL sbl-xbl.spamhaus.org. TXT
NAME_OF_RULE is the name of the rule to be
used, dnsbl_zone is the zone to look up IPs in, and lookuptype
is the type of lookup (TXT or A). Note that you must also
define a body-eval rule calling check_uridnsbl() to use this.
Example:
uridnsbl URIBL_SBLXBL sbl-xbl.spamhaus.org. TXT
body URIBL_SBLXBL eval:check_uridnsbl('URIBL_SBLXBL')
describe URIBL_SBLXBL Contains a URL listed in the SBL/XBL blocklist
NAME_OF_RULE is the name of the rule
to be used, rhsbl_zone is the zone to look up domain names in, and
lookuptype is the type of lookup (TXT or A). Note that you must also
define a body-eval rule calling check_uridnsbl() to use this.
An RHSBL zone is one where the domain name is looked up, as a string; e.g. a
URI using the domain foo.com will cause a lookup of foo.com.uriblzone.net.
Note that hostnames are stripped from the domain used in the URIBL lookup,
so the domain foo.bar.com will look up bar.com.uriblzone.net, and
foo.bar.co.uk will look up bar.co.uk.uriblzone.net.
Example:
urirhsbl URIBL_RHSBL rhsbl.example.org. TXT
NAME_OF_RULE is the
name of the rule to be used, rhsbl_zone is the zone to look up domain names
in, and lookuptype is the type of lookup (TXT or A).
subtest is the sub-test to run against the returned data. The sub-test may
either be an IPv4 dotted address for RHSBLs that return multiple A records, a
non-negative decimal number to specify a bitmask for RHSBLs that return a
single A record containing a bitmask of results, or (if none of the preceding
options seem to fit) a regular expression.
Note that, as with urirhsbl, you must also define a body-eval rule calling
check_uridnsbl() to use this.
Example:
urirhssub URIBL_RHSBL_4 rhsbl.example.org. A 127.0.0.4 urirhssub URIBL_RHSBL_8 rhsbl.example.org. A 8