Private DNSBL listed in DNSBL check: dnsbl.cyberlogic.net

Impacted versions

• Modoboa: git HEAD
• Installer used: irrelevant
• Webserver: irrelevant

Steps to reproduce

Look at email box, see that I have received various emails from the Modoboa MX checks about a DNSBL that is broken, badly maintained , irrelevant, and I never knew existed.

Current behavior

The list of DNSBLs defined at modoboa/admin/constants.py includes "dnsbl.cyberlogic.net", which is currently broken (see: https://www.dnsbl.com/2018/05/status-of-dnsblcyberlogicnet-broken.html). I never heard of this DNSBL, and the author of referenced article hasn’t either. Based on his findings I’m assuming that this DNSBL was actually private.

Expected behavior

1. I would not expect Modoboa to include such obscure DNSBLs by default, just a list of widely accepted and properly supported lists. Please remove the mentioned DNSBL from the modoboa defaults, and any other non-public DNSBLs too. For instance: cyberlogic doesn’t have a website listed at https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.cyberlogic.net, so performing manual lookups, reading about listing policy and/or getting a removal is a pain to say the least.
2. Proper documentation on how to remove DNSBLs from the list. I now found out (by reading the code) that Modoboa actually has quite nice support for removing/customizing this list. I fixed my issue by adding the following snippet to my settings.py, but this should be available for anyone reading documentation.

# fix broken DNSBLs
from modoboa.admin.constants import DNSBL_PROVIDERS
DNSBL_PROVIDERS.remove("dnsbl.cyberlogic.net")

[tonioo]

You can indeed modify the DNSBL provider list as mentioned in the original description, or you can just add DNSBL_PROVIDERS variable to the config file, without the import statement (in this mode, you can only override the whole list).

Anyway, do you think an online panel to control the provider list would be useful? I could propose it through the sponsoring system.

[whyscream]

My stance on DNSBLs is that you should only use those DNSBLs that have a clear listing policy (which is public), and getting removed from that list is also possible when you play by the rules of the DNSBL (meaning that those removal guide lines should also be public), as long as the DNSBL doesn’t requires payment to be removed. Parties I trust on these are:

• Spamhaus (zen.spamhaus.org)
• Spamcop (bl.spamcop.net)
• PSBL (psbl.surriel.com)
• SEM (bl.spameatingmonkey.net)
• Mailspike (bl.mailspike.net)

Many other DNSBLs fail to document why a server are listed, or how you can get it removed. This means in general that when your server is on such a list, you’re not in a position to fix the problem. It has no use for Modoboa users to be notified of such a listing, because they can’t overcome the issue anyway.