Skip to main content

CPANEL-42290 - Incorrect handling of zen.spamhaus.org

LBJ
The current cPanel implementation for handling the zen.spamhaus.org DNSBL needs correction. Using the tick-a-box method of enabling zen.spamhaus.org via the Exim Configuration Manager can result in naively rejecting clean email based on any non-empty return value. As per the spamhaus documentation, their system isn't limited to the basic return values in the range 127.0.0.[2..11] for listed IPs. They can also return a value of 127.255.255.0/24 as per... Last night, one of our private DNS servers was incorrectly flagged by them as being a public and open resolver, and they began returning request rejections in the 127.255.255.0/24 range. Surprisingly, the result was the rejection of all incoming items until our monitoring alerted us, and we disabled the zen.spamhaus checking, and raised a ticket with spamhaus. We never suspected the cPanel DNSBL implementation would be that silly, and looking at the implementation, it's a fairly minor correction that's needed. For example, to reject on SBL, CSS, XBL and PBL (all contained in ZEN), the following targeted test should be used... dnslists = zen.spamhaus.org=127.0.0.2,127.0.0.3,127.0.0.4,127.0.0.5,127.0.0.6,127.0.0.7,127.0.0.8,127.0.0.9,127.0.0.10,127.0.0.11
Currently the cPanel implementation just uses a naive test of... dnslists = zen.spamhaus.org
That fires off a rejection for any non-empty reply - including the 127.255.255.0/24 group which spamhaus clearly describes as "ERRORS (not implying a listed response)". This is not an enhancement. This is just a basic bug fix that's needed. Best regards, LBJ

Comments

3 comments

Date Votes
  • cPRex Jurassic Moderator
    Hey there! Thanks for the details. I've passed this along to our email developers through case CPANEL-42290 and I'll be sure to post an update here if I hear anything on my end!
    0
  • LBJ
    Hey there! Thanks for the details. I've passed this along to our email developers through case CPANEL-42290 and I'll be sure to post an update here if I hear anything on my end!

    Beautiful. Thank you very much. Best regards, LBJ
    0
  • cPRex Jurassic Moderator
    Sure thing!
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post