Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

By default EXIM4 only warns about mails with no reverse DNS. I need to block and actively reject mail which has no reverse DNS. I am willing to accept that it's possible that some legit mail will be blocked, however, so far the only mail with no reverse DNS has been spam.

Below is the code for reverse DNS checking from the EXIM4 config. How do I change this from warn to blocking.

# Warn if the sender host does not have valid reverse DNS.
  # 
  # If your system can do DNS lookups without delay or cost, you might want
  # to enable this.
  # If sender_host_address is defined, it's a remote call.  If
  # sender_host_name is not defined, then reverse lookup failed.  Use
  # this instead of !verify = reverse_host_lookup to catch deferrals
  # as well as outright failures.
  .ifdef CHECK_RCPT_REVERSE_DNS
  Reverse DNSReverse DNSwarn
    condition = ${if and{{def:sender_host_address}{!def:sender_host_name}}\
                      {yes}{no}}
    add_header = X-Host-Lookup-Failed: Reverse DNS lookup failed for $sender_host_address (${if eq{$host_lookup_failed}{1}{failed}{deferred}})
  .endif
share|improve this question
    
Thanks Lord of Time, I tried to use the code tags and couldn't figure them out so I gave up. –  Hunky Dory Apr 8 '13 at 19:00

1 Answer 1

This snippet should do it. If you are denying you may want to do this in the recipient ACL after you accept postmaster and abuse addresses. Watch which servers you reject, as some legitimate senders (airlines, banks, governments) have broken rDNS on their automated senders.

# Verify reverse DNS lookup of the sender's host.
deny
  message Reverse DNS verification failed
  !verify = reverse_host_lookup
  !hosts = ${if exists{CONFDIR/local_broken_dns_whitelist}\
                      {CONFDIR/local_broken_dns_whitelist} {}}

I find a lot of spambots give up quickly if they don't get a connection banner quickly enough. Including the following in a connect ACL may help. Disabling pipelining catches a number of spambots that don't behave well. If the delay is too long (over 30s) some legitimate servers will also give up.

# Verify reverse DNS lookup of the sender's host.
# Disable piplining and delay on failure.
warn
  !hosts = ${if exists{CONFDIR/local_broken_dns_whitelist}\
                      {CONFDIR/local_broken_dns_whitelist} {}}
  !verify = reverse_host_lookup
  control = no_pipelining
  delay = 10s
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.