Introduction

SORBS (Spam and Open Relay Blocking System) is a DNS-based Realtime Blackhole List (DNSBL) used to identify IP addresses associated with spam activity, open relays, and other unwanted mail sources.

By integrating SORBS with Exim, incoming SMTP connections can be checked against the blacklist database before accepting email. If the sender’s IP address is listed, Exim can reject the message or add a warning header for filtering.

Prerequisites

Before configuring SORBS with Exim, ensure the following requirements are met:

  • Exim 4.x is installed and running.
  • Root access to the mail server is available.
  • DNS resolution is working correctly.
  • SMTP service is functioning normally.
  • A backup of the Exim configuration file has been created.

Check the installed Exim version:

exim -bV

Backup the existing configuration:

cp /etc/exim/exim.conf /etc/exim/exim.conf.backup

Step 1: Locate Exim Configuration File

The Exim configuration location depends on the operating system.

Ubuntu / Debian

/etc/exim4/exim4.conf.template

or

/etc/exim4/conf.d/

RHEL / CentOS

/etc/exim/exim.conf

Open the Exim configuration file:

vi /etc/exim/exim.conf

Step 2: Configure SORBS to Reject Blacklisted Senders

Locate the acl_rcpt ACL section.

Add the following configuration:

deny
  message = Access denied - $sender_host_address\
            listed by $dnslist_domain\n$dnslist_text
  dnslists = dnsbl.sorbs.net

Configuration Explanation

ParameterDescription
denyRejects the incoming SMTP connection
messageDisplays the rejection message to the sender
$sender_host_addressShows the sender IP address
$dnslist_domainDisplays the DNS blacklist name
$dnslist_textDisplays the blacklist response
dnslistsDefines the DNS blacklist to query

Step 3: Add Warning Header Instead of Rejecting (Optional)

If you do not want to reject emails immediately, you can add a warning header.

Add the following rule:

warn
  message = X-Warning: $sender_host_address listed by $dnslist_domain
  log_message = Listed by $dnslist_domain
  dnslists = dnsbl.sorbs.net

This will add the following header to incoming emails:

X-Warning: <sender IP> listed by dnsbl.sorbs.net

Users can then create mail filters based on this header.

Step 4: Verify DNS Resolution

Check whether the SORBS DNSBL is reachable.

Command:

dig dnsbl.sorbs.net

or:

nslookup dnsbl.sorbs.net

A successful response confirms that DNS lookup is working.

Step 5: Validate Exim Configuration

Check the Exim configuration syntax:

exim -bV

or:

exim -bP

If there are no errors, continue with restarting the service.

Step 6: Restart Exim Service

Ubuntu / Debian

systemctl restart exim4

RHEL / CentOS

systemctl restart exim

Verify the service status:

systemctl status exim4

or:

systemctl status exim

Step 7: Monitor Exim Logs

Monitor incoming mail activity:

Ubuntu / Debian

tail -f /var/log/exim4/mainlog

RHEL / CentOS

tail -f /var/log/exim/mainlog

For systemd-based systems:

journalctl -u exim -f

Troubleshooting

IssuePossible CauseSolution
SORBS lookup failsDNS issueCheck DNS resolver configuration
Exim fails to restartConfiguration syntax errorValidate Exim configuration
Messages are not rejectedACL rule added incorrectlyConfirm rule is inside acl_rcpt
No blacklist responseDNSBL unavailableTest with dig/nslookup

Testing

After configuration, send a test email from a known blacklisted IP or verify DNSBL lookup manually.

Expected rejection response:

550-Access denied - <sender IP> listed by dnsbl.sorbs.net
550 Test entry.

Conclusion

Integrating SORBS RBL with Exim provides an additional layer of email security by blocking known spam sources during SMTP communication. This reduces spam delivery, lowers mail server resource usage, and improves overall email hygiene.

Administrators should regularly monitor Exim logs and review blacklist policies to ensure legitimate senders are not incorrectly blocked.

Post Views: 188

Leave a Reply