Here is the zone file for dnsbl.local on my DNS server. If you wish to email me directly my address is ashleymm72@hotmail.com.

;
;  Database file dnsbl.local.dns for dnsbl.local zone.
;      Zone version:  22
;

@                       IN  SOA raven.infopro.local.  admin.infopro.local. (
                         22           ; serial number
                         900          ; refresh
                         600          ; retry
                         86400        ; expire
                         3600       ) ; minimum TTL

;
;  Zone NS records
;

@                       NS raven.infopro.local.

;
;  Zone records
;

0.163.68.207            A 127.0.0.2

Ashley,

Can you post your actual zone file? Or, at least the "A" record in the zone ... the whole file would be better.

Dan

Ashley,

I asked LogSat to shoot you my address ... that way I can directly message to you an the dnsbl setup.

Dan

Well I think I got the dnsbl setup ...except it doesn't work...

07/31/03 16:00:33:822 -- (1528) Connection from: 207.68.163.78  -  Originating country : United States
07/31/03 16:00:34:431 -- (1528) Resolving 207.68.163.78 - sea1-f78.sea1.hotmail.com
07/31/03 16:00:34:431 -- (1528) - Domain is in local blacklist file...
07/31/03 16:00:34:431 -- (1528) RCPT TO: amillard@workaddress.com accepted
07/31/03 16:00:34:697 -- (1528) EMail from ashleymm72@hotmail.com to amillard@workaddress.com was queued. Size: 1 KB
07/31/03 16:00:34:712 -- (2384) Sending email from ashleymm72@hotmail.com to amillard@workaddress.com
07/31/03 16:00:34:791 -- (1528) Disconnect
07/31/03 16:00:34:916 -- (2384) EMail from ashleymm72@hotmail.com to amillard@workaddress.com  was forwarded to 10.1.1.98

This may be related to the other problem I posted about (http://www.logsat.com/spamfilter/forums/showmessage.asp?messageID=1541). The strange thing is the other MAPS queries are blocked.

Other details:
- Win2k server
- I put  0.163.68.207 A 127.0.0.2 in my DNS server. The nslookup returns 127.0.0.2 so i think that is setup correctly.

Ashely,

You are mostly correct on all acciunts.  The only way to create a record like that using the MS GUI is to create (under the parent domain) a "Domain", then another "Domain" then another "domain" and finaly a host of the final octet.  The GUI will even complain about that but will do it.

So .... really what I do is, have my application write directly to the zone file the line just as I showed in my previous post.  I increment the serial number (only required if you have a secondary that syncs for this) and I then force the zone to "Reload" the zone file.

Yippie for Microsoft!

Dan S.

So 178.85.100.12 is the host name which is created in the forward lookup zone and has the IP value of 127.0.0.2. So when a lookup is done on 178.85.10.12.dnsbl.domain.com it resolves to 127.0.0.2. Is that correct?

However I am not able to create hosts with decimals such as 178.85.100.12. I am using windows 2000's DNS server. I would have to create seperate domains and that seems excessive so either I don't understand or I just can't do it with windows.

OK ... if the ip you are trying to block is 12.100.85.178 , you will create a forward lookup UNDER the main zone that lo0ks like the following:

178.85.100.12           3600 A 127.0.0.2

So if your "Parent zone is dnsbl.domain.com, the lookup of 178.85.100.12.dnsbl.domain.com will yield 127.0.0.2

The standard dnsbl uses the reverse IP to do the lookup.

Did that help?

Dan S.

Dan,

This is interesting, I didn't realize this could be done. I am interested in getting this setup but haven't been able to get it to work. I have DNS running on two servers but set up the Forward lookup zone: dnsbl.local on the primary. (It should replicate over at some point.) Just to test it I tried blocking my hotmail email so I added a host with the IP 207.68.163.0 and host name of test. (most of my hotmail emails come from several IPs in that block.) Then I added dnsbl.local, true to my spamfilter.ini file. The emails still come through. Could you give some more details on setting that up? Bye the way, I can ping test.dnsbl.local and it comes back with the expected reply: timed out [207.68.163.0]. 

Also, when I enter an address such as 207.68.163.0 in the IP blacklist the message still comes though. Should the syntax be different than that?