[UNOFFICIAL - Community] Recommended exim blocklists to fight spam
If you want to improve blocking incoming spam emails on your DirectAdmin servers you need to set up blocklists for exim. These blocklists are being queried by your server when when you receive an email. By defaut your DirectAdmin installation uses 2 blocklists, Spamhaus and Barracudacentral. They are both very reliable but also a bit on the softer end, where they block less spam to reduce the amount of false positives. Setting up more blocklists will increase the amount of blocked spam coming to your server but might also have more false positives if you pick a blocklist that is too aggressive.
How to configure exim to use blocklists
/etc/exim.conf configuration (installation Q3 2023). It doesn't matter if your configuration looks slightly different.
You can add extra blocklists by creating a new file to override the settings in /etc/exim.conf which you should not edit, your changes might be lost some day. You create a new file: /etc/exim.strings.conf.custom
Note: the assignment of RBL_DNS_LIST is different from /etc/exim.conf if you look at = and ==
Make sure you restart exim after you change the configuration.
You can monitor the blocking by checking the exim rejectlog
My experiences with the following blocklists:
bl.spamcop.net
Very trustworthy and operating for many years. They tend to block a good amount of spam besides Spamhaus and Barracudacentral. The amount of false positives is very low. This one is a must for your setup.
"Spamcop.net is one of the oldest DNSBL’s of the many that are offered today. Their services were first publicly offered in 1992, and continue on to this day. On January 4, 2007 IronPort agreed to become a division of Cisco Systems, making SpamCop a Cisco service. While SpamCop is primarily a DNSBL, they also offer other services as well, such as email filtering, in which you can have SpamCop behave as an email delivery pre-filter.
SpamCop uses many of the same techniques as other DNSBL’s, such as spamtraps, honeypots, open relays, open proxies, whitelists, and blacklist ranges. However, the primary method by which SpamCop gathers it’s listing data is from end users. End users are encouraged to forward copies of their spam into the SpamCop system. These emails are then analyzed; if the email meets certain criteria, the IP address of the sending SMTP server will be listed in SpamCops DNSBL."
psbl.surriel.com ?
Blocks roughly the same amount of spam that SpamCop does. Both are pretty comparable. False positives are very low. Its not as “enterprise” as Spamhaus, Barracudacentral and SpamCop (they are backed by big companies) but they do operate since 2004.
"The Passive Spam Block List works in a really simple way. If one of the spamtraps receives email from a certain IP address, then that IP address gets listed. After a certain time the IP address times out and is automatically dropped from the list. However, if the IP address contains a real mail server, most likely one of the users of the mail server is going to notice the listing and will remove the mail server from the PSBL.
This way, mail servers should be listed on the PSBL for a short time, while spam zombies could stay listed for long times. Because of this the PSBL helps stop spam, while not unduly punishing the users of real mail servers that got abused once."
------
Other blocklists that I have not used myself but from what I read on different websites and forums they do have some reputation. Not all of them are exclusively spam blocklists.
xbl.spamhaus.org, Spamhaus has various separate lists
spam.spamrats.com
mail.bl.blocklist.de / imap.bl.blocklist.de / bl.blocklist.de
hostkarma.junkemailfilter.com
ix.dnsbl.manitu.net
combined.rbl.msrbl.net
spam.dnsbl.sorbs.net (lot of people complained that they flag email too fast, this one probably has the most false positives but might also block a fair amount of unknown spammers)
-> bl.mxrbl.com (this person is also active on DA forum, this is a relatively more aggressive blocklist than Spamhaus and Barracudacentral. Probably knows more of the unknown spam which is not yet flagged by the bigger RBLs. Will definitely help you block more spam)
Always do your own research before adding a blocklist to your exim configuration!
------
Good to mention that most of the RBL websites look very dated and not used anymore but don't let that mislead you.
------
You should also consider reading the following DirectAdmin official documentation about exim and fighting spam.
If you want to improve blocking incoming spam emails on your DirectAdmin servers you need to set up blocklists for exim. These blocklists are being queried by your server when when you receive an email. By defaut your DirectAdmin installation uses 2 blocklists, Spamhaus and Barracudacentral. They are both very reliable but also a bit on the softer end, where they block less spam to reduce the amount of false positives. Setting up more blocklists will increase the amount of blocked spam coming to your server but might also have more false positives if you pick a blocklist that is too aggressive.
How to configure exim to use blocklists
/etc/exim.conf configuration (installation Q3 2023). It doesn't matter if your configuration looks slightly different.
Bash:
RBL_DNS_LIST=\
b.barracudacentral.org : \
zen.spamhaus.orgYou can add extra blocklists by creating a new file to override the settings in /etc/exim.conf which you should not edit, your changes might be lost some day. You create a new file: /etc/exim.strings.conf.custom
Bash:
RBL_DNS_LIST==bl.spamcop.net : b.barracudacentral.org : zen.spamhaus.orgNote: the assignment of RBL_DNS_LIST is different from /etc/exim.conf if you look at = and ==
Bash:
cd /usr/local/directadmin/custombuild
./build set eximconf yes
./build exim_conf
#RHEL
systemctl restart eximMake sure you restart exim after you change the configuration.
You can monitor the blocking by checking the exim rejectlog
Bash:
cat /var/log/exim/rejectlog | grep 'Email blocked by'My experiences with the following blocklists:
bl.spamcop.net
Very trustworthy and operating for many years. They tend to block a good amount of spam besides Spamhaus and Barracudacentral. The amount of false positives is very low. This one is a must for your setup.
"Spamcop.net is one of the oldest DNSBL’s of the many that are offered today. Their services were first publicly offered in 1992, and continue on to this day. On January 4, 2007 IronPort agreed to become a division of Cisco Systems, making SpamCop a Cisco service. While SpamCop is primarily a DNSBL, they also offer other services as well, such as email filtering, in which you can have SpamCop behave as an email delivery pre-filter.
SpamCop uses many of the same techniques as other DNSBL’s, such as spamtraps, honeypots, open relays, open proxies, whitelists, and blacklist ranges. However, the primary method by which SpamCop gathers it’s listing data is from end users. End users are encouraged to forward copies of their spam into the SpamCop system. These emails are then analyzed; if the email meets certain criteria, the IP address of the sending SMTP server will be listed in SpamCops DNSBL."
psbl.surriel.com ?
Blocks roughly the same amount of spam that SpamCop does. Both are pretty comparable. False positives are very low. Its not as “enterprise” as Spamhaus, Barracudacentral and SpamCop (they are backed by big companies) but they do operate since 2004.
"The Passive Spam Block List works in a really simple way. If one of the spamtraps receives email from a certain IP address, then that IP address gets listed. After a certain time the IP address times out and is automatically dropped from the list. However, if the IP address contains a real mail server, most likely one of the users of the mail server is going to notice the listing and will remove the mail server from the PSBL.
This way, mail servers should be listed on the PSBL for a short time, while spam zombies could stay listed for long times. Because of this the PSBL helps stop spam, while not unduly punishing the users of real mail servers that got abused once."
------
Other blocklists that I have not used myself but from what I read on different websites and forums they do have some reputation. Not all of them are exclusively spam blocklists.
xbl.spamhaus.org, Spamhaus has various separate lists
spam.spamrats.com
mail.bl.blocklist.de / imap.bl.blocklist.de / bl.blocklist.de
hostkarma.junkemailfilter.com
ix.dnsbl.manitu.net
combined.rbl.msrbl.net
spam.dnsbl.sorbs.net (lot of people complained that they flag email too fast, this one probably has the most false positives but might also block a fair amount of unknown spammers)
-> bl.mxrbl.com (this person is also active on DA forum, this is a relatively more aggressive blocklist than Spamhaus and Barracudacentral. Probably knows more of the unknown spam which is not yet flagged by the bigger RBLs. Will definitely help you block more spam)
Always do your own research before adding a blocklist to your exim configuration!
------
Good to mention that most of the RBL websites look very dated and not used anymore but don't let that mislead you.
------
You should also consider reading the following DirectAdmin official documentation about exim and fighting spam.
Last edited:
