How can I exclude an IP address from evaluation by a Reputation Service (DNS Block List)?

This article applies to:

• Trustwave MailMarshal (SEG)

Question:

Procedure:

First, you will need to determine the IP address you wish to exclude, whether the IP address is listed on your RBL (Reputation Service or DNS Block List) of choice, if you still want to receive email from that server, or if you simply want to ensure a specific IP address never gets blocked by your RBL. 

Recommended method for most users:

The simplest way to exclude IP addresses is by using the rule condition Where sender's IP address matches address. Use this condition in the same rule as your Reputation Service (RBL or DNS Blocklist) condition.

• You can use this condition in Connection (Receiver) rules in SEG/MailMarshal 6.0 and above. 
• You can use this condition in Content Analysis (Standard) rules in SEG/MailMarshal version 6.4.5 and above (using the Category rule condition to select a RBL).
• This condition allows you to enter one or more individual IP addresses or ranges of addresses.
• To exclude an address or range, clear the box "include" at the bottom of the Match IP Address window.

Method for version 6.4.1 and below, and advanced usage:

To exclude individual IP addresses from blocklist evaluation, you can add exclusions to the XML category file for the specific list, or to the userdefined.xml include file. This is the only way to exclude IP addresses in a Standard rule for MailMarshal 6.4.1 and below. However this method is no longer recommended for general use. Advanced users who are combining multiple conditions in a rule might find a use for this method.

Follow these steps to add this IP to an RBL exclusion list:

1. Browse to C:\Program Files\NetIQ\MailMarshal\Config.
2. Edit the userdefined.xml file with Notepad. If you are using specific XML files to deploy an RBL (such as SpamCop.xml or SpamHaus.xml) then edit that file instead.
3. Scroll down to <Group Name="DNSBlacklistExclusions">.
4. Enter the IP address and domain name in IP domain name format.  For example:
   • 202.37.162.70   Marshal Software
5. Save the XML file.
6. Commit Configuration Changes.
7. Restart your MailMarshal Engine Service.

It is not possible to add a range of addresses to an exclusion list by this method. Advanced users may be able to exclude a range by constructing a Category Regular Expression rule that matches an IP range, and giving the rule negative weight. For advanced information about customizing SpamCensor, see the "MailMarshal SMTP Anti-Spam Advanced Configuration" whitepaper, available on the MailMarshal SMTP documentation page.

This article was previously published as:

NETIQKB40086