Enable dnsdb in Exim
Since some time in 2009, dnsdb has been part of the default build of Exim (http://bugs.exim.org/show_bug.cgi?id=847) but it appears that it is actively disabled by cPanel (checked in Exim 4.82-2-cp1136).
dnsdb support would add a tiny overhead (approximately 4kb in size to the binary) and enables a really useful advanced ACLs in Exim based on DNS records.
As a topical example, with dnsdb support it would be possible to disable sender callout verification for domains based on MX record whilst still leaving callouts otherwise enabled; this is especially relevant as Hotmail have decided to start blacklisting people who they perceive to be doing namespace mining, and a sender verify callout is indistinguishable from namespace mining.
Disabling sender callouts based on Hotmail's MTA IP addresses is insufficient to address this issue, as mail with a forged from header from 3rd party servers would still cause callouts to happen to hotmail, and still cause you to be blacklisted. Not to mention the fact that you'd have to maintain (more than likely by hand) a list of IP addresses in the exemption list to keep up with changes Microsoft make, etc. Instead, it would be possible to create a sender verify callout that first tests if the domain in the from header does NOT have MX records pointing to mx{n}.hotmail.com.
Some other examples of what you could do with dnsdb (taken from http://www.gossamer-threads.com/lists/exim/users/83521#83521):
- A plain PTR lookup without the equivalent forward lookup.
- Checking whether or not an SPF record exists for a domain
- Setting $smtp_active_hostname to the PTR record for $interface_address
- Querying the TOR exit node list
- Querying an "emailbl"
- Checking how many MX records a domain has
- Checking if a domain name has NS servers or not
- Checking if the NS servers for a domain are listed on some DNS based BL
- Automatically checking if the connecting host has connected to the primary MX or secondary MX for the domain it is attempting to deliver mail to.
Other people have previously asked for this:
- https://forums.cpanel.net/f145/add-support-dnsdb-lookups-exim-198111.html
- http://forums.cpanel.net/f5/exim-lookups-51540.html
Another user who's wanted to use rules that rely on dnsdb:
I like this idea 
cPanel, WebHost Manager and WHM are registered trademarks of cPanel, L.L.C. for providing its computer software that facilitates the management and configuration of Internet web servers.
I have no idea why that's formatted so badly. Let's try reformatting it again to make it readable:
Since some time in 2009, dnsdb has been part of the default build of Exim (http://bugs.exim.org/show_bug.cgi?id=847) but it appears that it is actively disabled by cPanel (checked in Exim 4.82-2-cp1136).
dnsdb support would add a tiny overhead (approximately 4kb in size to the binary) and enables a really useful advanced ACLs in Exim based on DNS records.
As a topical example, with dnsdb support it would be possible to disable sender callout verification for domains based on MX record whilst still leaving callouts otherwise enabled; this is especially relevant as Hotmail have decided to start blacklisting people who they perceive to be doing namespace mining, and a sender verify callout is indistinguishable from namespace mining.
Disabling sender callouts based on Hotmail's MTA IP addresses is insufficient to address this issue, as mail with a forged from header from 3rd party servers would still cause callouts to happen to hotmail, and still cause you to be blacklisted. Not to mention the fact that you'd have to maintain (more than likely by hand) a list of IP addresses in the exemption list to keep up with changes Microsoft make, etc. Instead, it would be possible to create a sender verify callout that first tests if the domain in the from header does NOT have MX records pointing to mx{n}.hotmail.com.
Some other examples of what you could do with dnsdb (taken from http://www.gossamer-threads.com/lists/exim/users/83521#83521):
Other people have previously asked for this:
https://forums.cpanel.net/f145/add-support-dnsdb-lookups-exim-198111.html
http://forums.cpanel.net/f5/exim-lookups-51540.html
Another user who's wanted to use rules that rely on dnsdb:
http://forums.cpanel.net/f5/filter-spam-image-question-60294.html
I have no idea why that's formatted so badly. Let's try reformatting it again to make it readable:
Since some time in 2009, dnsdb has been part of the default build of Exim (http://bugs.exim.org/show_bug.cgi?id=847) but it appears that it is actively disabled by cPanel (checked in Exim 4.82-2-cp1136).
dnsdb support would add a tiny overhead (approximately 4kb in size to the binary) and enables a really useful advanced ACLs in Exim based on DNS records.
As a topical example, with dnsdb support it would be possible to disable sender callout verification for domains based on MX record whilst still leaving callouts otherwise enabled; this is especially relevant as Hotmail have decided to start blacklisting people who they perceive to be doing namespace mining, and a sender verify callout is indistinguishable from namespace mining.
Disabling sender callouts based on Hotmail's MTA IP addresses is insufficient to address this issue, as mail with a forged from header from 3rd party servers would still cause callouts to happen to hotmail, and still cause you to be blacklisted. Not to mention the fact that you'd have to maintain (more than likely by hand) a list of IP addresses in the exemption list to keep up with changes Microsoft make, etc. Instead, it would be possible to create a sender verify callout that first tests if the domain in the from header does NOT have MX records pointing to mx{n}.hotmail.com.
Some other examples of what you could do with dnsdb (taken from http://www.gossamer-threads.com/lists/exim/users/83521#83521):
Other people have previously asked for this:
https://forums.cpanel.net/f145/add-support-dnsdb-lookups-exim-198111.html
http://forums.cpanel.net/f5/exim-lookups-51540.html
Another user who's wanted to use rules that rely on dnsdb:
http://forums.cpanel.net/f5/filter-spam-image-question-60294.html
Thank you for submitting a reformatted version. I updated the original request.
Thank you for submitting a reformatted version. I updated the original request.
Fighting spam is very difficult, especially when very important tools like DNSDB are not enabled. I am very upset about this.
Fighting spam is very difficult, especially when very important tools like DNSDB are not enabled. I am very upset about this.
Must have!
Must have!
This needs to be done. A very useful feature for killing spam.
This needs to be done. A very useful feature for killing spam.
This is one of those features that when you need it, not having it is a huge pain in the ***.
This is one of those features that when you need it, not having it is a huge pain in the ***.
Yes, please enable by default dnsdb.
Yes, please enable by default dnsdb.
Ken, we need this!
Ken, we need this!
Hi, we have updated exim for 11.50. DNSDB will be included.
Hi, we have updated exim for 11.50. DNSDB will be included.
Replies have been locked on this page!