[GH-ISSUE #921] DNSBL report incorrect #797

Closed
opened 2026-02-27 11:13:35 +03:00 by kerem · 20 comments
Owner

Originally created by @dugite-code on GitHub (Sep 19, 2016).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/921

Originally assigned to: @tonioo on GitHub.

Just upgraded to 1.6.0 from 1.5.1

added new crontab entries then manually ran /srv/modoboa/env/bin/python /srv/modoboa/instance/manage.py modo check_mx as vmail with no errors. All DNSBL show as listed, my manual checks (where possible) show no listings. using dnsbl.info only dnsbl-3.uceprotect.net shows listed due to my server being a digital ocean droplet (minor issue).

I am unsure how to debug this issue. I have set debugging to True in settings.py is there a log file I can check?

Originally created by @dugite-code on GitHub (Sep 19, 2016). Original GitHub issue: https://github.com/modoboa/modoboa/issues/921 Originally assigned to: @tonioo on GitHub. Just upgraded to 1.6.0 from 1.5.1 added new crontab entries then manually ran `/srv/modoboa/env/bin/python /srv/modoboa/instance/manage.py modo check_mx` as vmail with no errors. All DNSBL show as listed, my manual checks (where possible) show no listings. using dnsbl.info only dnsbl-3.uceprotect.net shows listed due to my server being a digital ocean droplet (minor issue). I am unsure how to debug this issue. I have set debugging to True in settings.py is there a log file I can check?
kerem 2026-02-27 11:13:35 +03:00
Author
Owner

@tonioo commented on GitHub (Sep 19, 2016):

Could you paste some screenshots please ?

<!-- gh-comment-id:247925106 --> @tonioo commented on GitHub (Sep 19, 2016): Could you paste some screenshots please ?
Author
Owner

@dugite-code commented on GitHub (Sep 22, 2016):

Is this what you're after? It's every DNSBL provider from the constants.py file.

PS: I just did a fresh install on a new droplet (broke stuff with my tinkering) issue is pressent with a brand new install.

domains

<!-- gh-comment-id:248794146 --> @dugite-code commented on GitHub (Sep 22, 2016): Is this what you're after? It's every DNSBL provider from the `constants.py` file. PS: I just did a fresh install on a new droplet (broke stuff with my tinkering) issue is pressent with a brand new install. ![domains](https://cloud.githubusercontent.com/assets/12742064/18734841/ce7df99c-80aa-11e6-852a-c2458da8ba67.png)
Author
Owner

@tonioo commented on GitHub (Sep 30, 2016):

Have you checked that the MX record found by Modoboa is the right one ?

<!-- gh-comment-id:250744342 --> @tonioo commented on GitHub (Sep 30, 2016): Have you checked that the MX record found by Modoboa is the right one ?
Author
Owner

@dugite-code commented on GitHub (Oct 3, 2016):

MX record is correct with correct IP address. I also have reverse DNS lookup working.

  • Only thing I've added to my blank Ubuntu install is UFW but the default behavior for outgoing traffic is allow
<!-- gh-comment-id:251010039 --> @dugite-code commented on GitHub (Oct 3, 2016): MX record is correct with correct IP address. I also have reverse DNS lookup working. - Only thing I've added to my blank Ubuntu install is UFW but the default behavior for outgoing traffic is allow
Author
Owner

@hennedo commented on GitHub (Oct 3, 2016):

I can confirm this behaviour on a fresh installation of Ubuntu 16.04 without ufw.

<!-- gh-comment-id:251251713 --> @hennedo commented on GitHub (Oct 3, 2016): I can confirm this behaviour on a fresh installation of Ubuntu 16.04 without ufw.
Author
Owner

@tonioo commented on GitHub (Oct 4, 2016):

Guys, would be easier to debug if one of you could give me a domain name that fails. Do not hesitate to send me a private message.

<!-- gh-comment-id:251333693 --> @tonioo commented on GitHub (Oct 4, 2016): Guys, would be easier to debug if one of you could give me a domain name that fails. Do not hesitate to send me a private message.
Author
Owner

@hennedo commented on GitHub (Oct 4, 2016):

Try smells.sexy :)

<!-- gh-comment-id:251348760 --> @hennedo commented on GitHub (Oct 4, 2016): Try smells.sexy :)
Author
Owner

@tonioo commented on GitHub (Oct 4, 2016):

Thank you. I'm sorry but I fail to reproduce your issue... I see your domain as not blacklisted. Where is your server ? Is there any DNS limitation or something similar which could cause this ?

<!-- gh-comment-id:251454145 --> @tonioo commented on GitHub (Oct 4, 2016): Thank you. I'm sorry but I fail to reproduce your issue... I see your domain as not blacklisted. Where is your server ? Is there any DNS limitation or something similar which could cause this ?
Author
Owner

@hennedo commented on GitHub (Oct 4, 2016):

Not that i'm aware of it..

When I manually try to query the ip, it shows the following

root@mail:/ dig 66.30.172.31.bl.spamcop.net

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 66.30.172.31.bl.spamcop.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58068
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;66.30.172.31.bl.spamcop.net.   IN  A

;; AUTHORITY SECTION:
bl.spamcop.net.     0   IN  SOA bl.spamcop.net. hostmaster.admin.spamcop.net. 1475602051 3600 1800 3600 0

;; Query time: 32 msec
;; SERVER: 195.182.2.2#53(195.182.2.2)
;; WHEN: Tue Oct 04 19:28:54 CEST 2016
;; MSG SIZE  rcvd: 109

Which is fine, if i'm not mistaking... I will have a look at the code tonight..

<!-- gh-comment-id:251456835 --> @hennedo commented on GitHub (Oct 4, 2016): Not that i'm aware of it.. When I manually try to query the ip, it shows the following ``` root@mail:/ dig 66.30.172.31.bl.spamcop.net ; <<>> DiG 9.10.3-P4-Ubuntu <<>> 66.30.172.31.bl.spamcop.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58068 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;66.30.172.31.bl.spamcop.net. IN A ;; AUTHORITY SECTION: bl.spamcop.net. 0 IN SOA bl.spamcop.net. hostmaster.admin.spamcop.net. 1475602051 3600 1800 3600 0 ;; Query time: 32 msec ;; SERVER: 195.182.2.2#53(195.182.2.2) ;; WHEN: Tue Oct 04 19:28:54 CEST 2016 ;; MSG SIZE rcvd: 109 ``` Which is fine, if i'm not mistaking... I will have a look at the code tonight..
Author
Owner

@tonioo commented on GitHub (Oct 5, 2016):

Yes, it is fine. Which user runs the management command ?

<!-- gh-comment-id:251658521 --> @tonioo commented on GitHub (Oct 5, 2016): Yes, it is fine. Which user runs the management command ?
Author
Owner

@tonioo commented on GitHub (Oct 5, 2016):

@dugite-code Have you tried to run the command as root ?

<!-- gh-comment-id:251659282 --> @tonioo commented on GitHub (Oct 5, 2016): @dugite-code Have you tried to run the command as root ?
Author
Owner

@hennedo commented on GitHub (Oct 5, 2016):

Found the error!
I had set a DNS Search Domain in my /etc/resolv.conf.
socket.gethostbyname always returned the IP address of my Webserver. The Searchdomain also is the hostname of my Webserver, so it seems, when socket.gethostbyname cannot resolve the Hostname, it takes the IP of the searchdomain.

Removing the Searchdomain fixed this.

(and the script crashes if no MX is present now... mhh did I break something? :D the try..catch, doesn't seem to catch the "dns.resolver.NXDOMAIN" error, which is raised if no MX is present...)

^- forget that, this seems to be already fixed in the current git master...

<!-- gh-comment-id:251711978 --> @hennedo commented on GitHub (Oct 5, 2016): Found the error! I had set a DNS Search Domain in my /etc/resolv.conf. socket.gethostbyname always returned the IP address of my Webserver. The Searchdomain also is the hostname of my Webserver, so it seems, when socket.gethostbyname cannot resolve the Hostname, it takes the IP of the searchdomain. Removing the Searchdomain fixed this. (and the script crashes if no MX is present now... mhh did I break something? :D the try..catch, doesn't seem to catch the "dns.resolver.NXDOMAIN" error, which is raised if no MX is present...) ^- forget that, this seems to be already fixed in the current git master...
Author
Owner

@dugite-code commented on GitHub (Oct 6, 2016):

@tonioo just gave it a shot running as root with no change * Edit just sent you my domain details via email

I also got the same result using dig

@henne- Unfortunately I don't have a dns search domain defined.

<!-- gh-comment-id:251847631 --> @dugite-code commented on GitHub (Oct 6, 2016): @tonioo just gave it a shot running as root with no change \* Edit just sent you my domain details via email I also got the same result using dig @henne- Unfortunately I don't have a dns search domain defined.
Author
Owner

@awein commented on GitHub (Oct 9, 2016):

This issue is caused by a missing domain entry in the resolv.conf file. An empty value might still cause issues in case your hostname is a subdomain (like mail.example.com).

@tonioo I suggest to append a . at the end of the hostname (which will force the name to be the full DNS name instead of a relative one)
(e.g. bl.spamcop.net. instead of bl.spamcop.net)

The workaround until then is to add the following line to the /etc/resolv.conf:

domain .
<!-- gh-comment-id:252473551 --> @awein commented on GitHub (Oct 9, 2016): This issue is caused by a missing domain entry in the `resolv.conf` file. An empty value might still cause issues in case your hostname is a subdomain (like mail.example.com). @tonioo I suggest to append a `.` at the end of the hostname (which will force the name to be the full DNS name instead of a relative one) (e.g. `bl.spamcop.net.` instead of `bl.spamcop.net`) The workaround until then is to add the following line to the `/etc/resolv.conf`: ``` domain . ```
Author
Owner

@dugite-code commented on GitHub (Oct 10, 2016):

I can confirm adding domain . to my /etc/resolv.conf fixed this issue for me. Thanks @awein

*edit: yes my domain was a subdomain like mail.mydomain.com

<!-- gh-comment-id:252527163 --> @dugite-code commented on GitHub (Oct 10, 2016): I can confirm adding `domain .` to my `/etc/resolv.conf` fixed this issue for me. Thanks @awein *edit: yes my domain was a subdomain like mail.mydomain.com
Author
Owner

@dugite-code commented on GitHub (Oct 10, 2016):

Incidentally dnsbl.njabl.org show's listed but according to dnsbl.info and vamsoft.com njabl.org has been shutdown and should probably be removed.

<!-- gh-comment-id:252527405 --> @dugite-code commented on GitHub (Oct 10, 2016): Incidentally dnsbl.njabl.org show's listed but according to [dnsbl.info](http://www.dnsbl.info/dnsbl-njabl-org.php) and [vamsoft.com](http://vamsoft.com/support/docs/knowledge-base/njabl-shutdown) njabl.org has been shutdown and should probably be removed.
Author
Owner

@ghost commented on GitHub (Oct 10, 2016):

Are you guys using some public DNS resolver? Because many DNSBL services are known to block or limit the queries from such resolvers.

I use my own DNS resolver (Unbound), so I only have nameserver 127.0.0.1 in resolv.conf file. And everything is fine here with many domains.

Just my 2 cents.

<!-- gh-comment-id:252527470 --> @ghost commented on GitHub (Oct 10, 2016): Are you guys using some public DNS resolver? Because many DNSBL services are known to block or limit the queries from such resolvers. I use my own DNS resolver (Unbound), so I only have `nameserver 127.0.0.1` in resolv.conf file. And everything is fine here with many domains. Just my 2 cents.
Author
Owner

@dugite-code commented on GitHub (Oct 10, 2016):

@csmk that's interesting to know. I'm using the google name servers because I honestly didn't think of changing the default settings.

My Digital Ocean droplet built using their Ubuntu 16.04.1 x64 image /etc/resolv.conf

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 8.8.8.8
nameserver 8.8.4.4
<!-- gh-comment-id:252527900 --> @dugite-code commented on GitHub (Oct 10, 2016): @csmk that's interesting to know. I'm using the google name servers because I honestly didn't think of changing the default settings. My Digital Ocean droplet built using their `Ubuntu 16.04.1 x64` image `/etc/resolv.conf` ``` # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN nameserver 8.8.8.8 nameserver 8.8.4.4 ```
Author
Owner

@tonioo commented on GitHub (Oct 10, 2016):

@awein Thank you! I'll update the code.

<!-- gh-comment-id:252565513 --> @tonioo commented on GitHub (Oct 10, 2016): @awein Thank you! I'll update the code.
Author
Owner

@gabsoftware commented on GitHub (Mar 29, 2022):

Are you guys using some public DNS resolver? Because many DNSBL services are known to block or limit the queries from such resolvers.

I use my own DNS resolver (Unbound), so I only have nameserver 127.0.0.1 in resolv.conf file. And everything is fine here with many domains.

Just my 2 cents.

That was it! zen.spamhaus.org refused DNS queries with public DNS resolvers, even the ECS enabled 9.9.9.11... Which should have worked according to their usage terms https://www.spamhaus.org/organization/dnsblusage/ .

<!-- gh-comment-id:1081851181 --> @gabsoftware commented on GitHub (Mar 29, 2022): > Are you guys using some public DNS resolver? Because many DNSBL services are known to block or limit the queries from such resolvers. > > I use my own DNS resolver (Unbound), so I only have `nameserver 127.0.0.1` in resolv.conf file. And everything is fine here with many domains. > > Just my 2 cents. That was it! zen.spamhaus.org refused DNS queries with public DNS resolvers, even the ECS enabled 9.9.9.11... Which should have worked according to their usage terms https://www.spamhaus.org/organization/dnsblusage/ .
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/modoboa-modoboa#797
No description provided.