This article applies to:
- Trustwave MailMarshal (SEG)
Question:
- How do I determine if MailMarshal SMTP is using a DNS blocklist?
Procedure:
To check for use of DNS blocklists, you will need to go through each rule in your email policy individually. MailMarshal SMTP can query a DNS-based blocklist (DNSBL) in two different ways: through a Connection (receiver) rule or through a Content Analysis (standard/Engine) rule.
- You can use the Rule Print feature available in most versions to quickly review rules.
In Connection rules, the condition that causes a DNSBL to be checked is Where sender’s IP address is listed by reputation service (in older versions of MailMarshal, Where sender’s IP address is listed in DNS Blacklist).
- Check each enabled Connection rule in your email policy. If any of them use that condition, you are using the DNS blocklist provider specified in the rule.
- Depending on the version of MailMarshal, the default Connection rules might use the Marshal RBL/Trustwave Reputation Service, Spamhaus, Spamcop, or SORBs. Rules using third party services were disabled by default.
Content Analysis (engine) rules use category scripts to check DNS blocklists. Trustwave provides sample category scripts for popular DNS blocklists that can be used out of the box. The condition used in the Standard rule to check a category script is Where message is categorized as category.
- Check each enabled Content Analysis rule in your email policy. If any of them use that condition, you are using the DNS blocklist provider specified in the category script. Scripts provided by default include:
- Marshal RBL Blacklisted
- Spamhaus Blacklisted
- Spamcop Blacklisted
- SORBs Blacklisted
- In some versions of MailMarshal, the default policy includes Content Analysis rules using DNSBLs that were enabled by default.
Notes:
Advanced users could also create or customize category scripts that use DNS blocklists. Checking the configuration of custom scripts is beyond the scope of this article.