Add support for Spamhaus DQS #2509
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Mail-in-a-Box uses the free blocklists made available by Spamhaus to detect spammy servers, and to verify that our own boxes are not listed with Spamhaus. To do this properly, Mail-in-a-Box includes a local dns resolver (bind) to query the Spamhaus servers.
I recently encountered a limitation with this setup. It turns out that for a number of providers, Spamhaus cannot properly (their words) attribute the DNS queries coming from various VPS providers. For instance Hetzner, Digital Ocean or Microsoft. You can see whether your box is impacted when the Spamhaus DNS blocklists return the code
127.255.255.254
. Mail-in-a-Box recognizes this code, and reports it in the System Status Checks as "Mail-in-a-Box is configured to use a public DNS server. This is not supported by spamhaus."Spamhaus also offers a solution: make use of the Spamhaus Data Query Services. For this you need to create an account with Spamhaus, and configure your DNS queries to make use of the DQS servers.
This pull request adds support for the Spamhaus DQS servers. It configures postfix, spamassassin and the Mail-in-a-Box daemon to use the DQS servers. To enable it, add a line in
/etc/mailinabox.conf
containing:SPAMHAUS_DQS_KEY=<query_key>
The query_key is the DQS Key that can be generated at https://portal.spamhaus.com/dqs/ If no query key is configured, it defaults to using the public Spamhaus servers, which is what is currently implemented.I chose to configure this via
/etc/mailinabox.conf
, but if desired I can change it to make use of/home/user-data/settings.yaml
Note: If you don´t want to use the Spamhaus DQS, and spamhaus returns the
127.255.255.254
code to your box, that is fine. Mail-in-a-Box recognizes the code and thus ignores this return code. However, you then don´t have the benefit of the Spamhaus bad server reports.