SORBS (Spam and Open Relay Blocking System) is a DNS-based Realtime Blackhole List (DNSBL) used to identify IP addresses associated with spam activity, open relays, and other unwanted mail sources.<\/p>\n\n\n\n
By integrating SORBS with Exim, incoming SMTP connections can be checked against the blacklist database before accepting email. If the sender’s IP address is listed, Exim can reject the message or add a warning header for filtering.<\/p>\n\n\n\n
Before configuring SORBS with Exim, ensure the following requirements are met:<\/p>\n\n\n\n
Check the installed Exim version:<\/p>\n\n\n\n
exim -bV\n<\/pre>\n\n\n\nBackup the existing configuration:<\/p>\n\n\n\n
cp \/etc\/exim\/exim.conf \/etc\/exim\/exim.conf.backup\n<\/pre>\n\n\n\n
\n\n\n\nStep 1: Locate Exim Configuration File<\/h1>\n\n\n\n
The Exim configuration location depends on the operating system.<\/p>\n\n\n\n
Ubuntu \/ Debian<\/h2>\n\n\n\n
\/etc\/exim4\/exim4.conf.template\n<\/pre>\n\n\n\nor<\/p>\n\n\n\n
\/etc\/exim4\/conf.d\/\n<\/pre>\n\n\n\nRHEL \/ CentOS<\/h2>\n\n\n\n
\/etc\/exim\/exim.conf\n<\/pre>\n\n\n\nOpen the Exim configuration file:<\/p>\n\n\n\n
vi \/etc\/exim\/exim.conf\n<\/pre>\n\n\n\n
\n\n\n\nStep 2: Configure SORBS to Reject Blacklisted Senders<\/h1>\n\n\n\n
Locate the acl_rcpt<\/strong> ACL section.<\/p>\n\n\n\n
Add the following configuration:<\/p>\n\n\n\n
deny\n message = Access denied - $sender_host_address\\\n listed by $dnslist_domain\\n$dnslist_text\n dnslists = dnsbl.sorbs.net\n<\/pre>\n\n\n\n
\n\n\n\nConfiguration Explanation<\/h1>\n\n\n\n
Parameter<\/th> Description<\/th><\/tr><\/thead> deny<\/td> Rejects the incoming SMTP connection<\/td><\/tr> message<\/td> Displays the rejection message to the sender<\/td><\/tr> $sender_host_address<\/td> Shows the sender IP address<\/td><\/tr> $dnslist_domain<\/td> Displays the DNS blacklist name<\/td><\/tr> $dnslist_text<\/td> Displays the blacklist response<\/td><\/tr> dnslists<\/td> Defines the DNS blacklist to query<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\nStep 3: Add Warning Header Instead of Rejecting (Optional)<\/h1>\n\n\n\n
If you do not want to reject emails immediately, you can add a warning header.<\/p>\n\n\n\n
Add the following rule:<\/p>\n\n\n\n
warn\n message = X-Warning: $sender_host_address listed by $dnslist_domain\n log_message = Listed by $dnslist_domain\n dnslists = dnsbl.sorbs.net\n<\/pre>\n\n\n\nThis will add the following header to incoming emails:<\/p>\n\n\n\n
X-Warning: <sender IP> listed by dnsbl.sorbs.net\n<\/pre>\n\n\n\nUsers can then create mail filters based on this header.<\/p>\n\n\n\n
\n\n\n\nStep 4: Verify DNS Resolution<\/h1>\n\n\n\n
Check whether the SORBS DNSBL is reachable.<\/p>\n\n\n\n
Command:<\/p>\n\n\n\n
dig dnsbl.sorbs.net\n<\/pre>\n\n\n\nor:<\/p>\n\n\n\n
nslookup dnsbl.sorbs.net\n<\/pre>\n\n\n\nA successful response confirms that DNS lookup is working.<\/p>\n\n\n\n
\n\n\n\nStep 5: Validate Exim Configuration<\/h1>\n\n\n\n
Check the Exim configuration syntax:<\/p>\n\n\n\n
exim -bV\n<\/pre>\n\n\n\nor:<\/p>\n\n\n\n
exim -bP\n<\/pre>\n\n\n\nIf there are no errors, continue with restarting the service.<\/p>\n\n\n\n
\n\n\n\nStep 6: Restart Exim Service<\/h1>\n\n\n\n
Ubuntu \/ Debian<\/h2>\n\n\n\n
systemctl restart exim4\n<\/pre>\n\n\n\nRHEL \/ CentOS<\/h2>\n\n\n\n
systemctl restart exim\n<\/pre>\n\n\n\nVerify the service status:<\/p>\n\n\n\n
systemctl status exim4\n<\/pre>\n\n\n\nor:<\/p>\n\n\n\n
systemctl status exim\n<\/pre>\n\n\n\n
\n\n\n\nStep 7: Monitor Exim Logs<\/h1>\n\n\n\n
Monitor incoming mail activity:<\/p>\n\n\n\n
Ubuntu \/ Debian<\/h2>\n\n\n\n
tail -f \/var\/log\/exim4\/mainlog\n<\/pre>\n\n\n\nRHEL \/ CentOS<\/h2>\n\n\n\n
tail -f \/var\/log\/exim\/mainlog\n<\/pre>\n\n\n\nFor systemd-based systems:<\/p>\n\n\n\n
journalctl -u exim -f\n<\/pre>\n\n\n\n
\n\n\n\nTroubleshooting<\/h1>\n\n\n\n