Re: Block No Reverse DNS

Matt <[email protected]> wrote:
> How do you setup Exim to refuse email from MTA's that do not have a valid 
> reverse DNS?
> 
> I also heard of some hack that allowed you to look at a reverse DNS and if 
> it contained *dial*, *dsl*, *cable*, *208-34-34-34*, *204.34.34.34* or 
> something like that refuse it since it would likely be a dynamic IP pool. 
> Anyone know the trick for that?
> 
> Using tricks like this about how much legitiment email do you think would 
> be blocked?

I personally just 'warn' if there is no reverse DNS setup.  At lot of 
legitimate sites seem to have bad PTR records.  But then again I cannot be
as 'tight' as I would like sometimes because of my customer's needs.

I do setup a delay if the reverse DNS is bad.  Here is a snippet from my
configure file in the acl_connect ACL:

#-----------------------------------------------------------------------------
# Record the current timestamp, in order to calculate elapsed time for
# subsequent delays
warn
  set acl_m2 = $tod_epoch
                                                                                
#-----------------------------------------------------------------------------
# If reverse DNS lookup of the sender's host fails (i.e. there is no rDNS
# entry, or a forward lookup of the resulting name does not match the original
# IP address), then generate a warning message in $acl_c4.  We will later add
# this message to the mail header.  Also, stall the sender until 20 secs have
# elapsed.
accept
  !verify     = reverse_host_lookup
  set acl_m8  = Reverse DNS lookup failed for host $sender_host_address
  set acl_c4  = X-DNS-Warning: $acl_m8
  set acl_m2  = ${eval:20 + $acl_m2 - $tod_epoch}
  log_message = $acl_m8 - delay $acl_m2 seconds
  delay       = ${if >{$acl_m2}{0}{$acl_m2}{0}}s
                                                                                
#-----------------------------------------------------------------------------
# Accept the connection.
accept

I actually add the X-DNS-Warning header in the RCPT ACL which is why it gets
stored in a variable.  The effect of the above is that if the reverse DNS is
bad Exim will delay for 20 seconds.  This will sometimes stop spammers as 
they will just drop the connection if there is a delay.

I hope this helps,
mikeS

-- 
Michael Sprague  | [email protected]
Partner          | System and Network Engineering (SaNE), LLC
use STD::disclaimer;