Skip to main content

Query to URIBL was blocked - pDNS & Bind

bloatedstoat
Hello, I've been ploughing through posts that deal with the "Query to URIBL was blocked" error with blacklists. I have this working on an older machine, but that machine runs Bind and the resolver is set to 127.0.0.1, the RBL checks work like a charm and bin so much potential spam. The new server currently has pDNS on it, I know there are two versions of pDNS and as it turns out the one that came pre-installed on the new machine isn't a caching nameserver, I believe I would need to install the recursive version of PDNS to gain this functionality? So here's the question. In order to get the blacklists working do I install the recursor pdns as an addition or switch to Bind? I only need to resolve on 127.0.0.1 for the blacklists and that's it. Switching to Bind just for this seems a bit heavy handed. Anyone else dealt with this? Thanks.

Comments

16 comments

Date Votes
  • SimpleTechGuy
    Hi, I spent several hours dealing with this as well, so I feel your pain. I heavily researched the pdns recursor option, but it was fairly complex and since it's not officially a part of cpanel, then it's not supported and would most likely have issues during updates. **note, there is a feature request for this, so vote if you think it will help: /etc/mail/spamassassin/local.cf
    ) Sorry it's not more detailed, but this option does seem to be working fine. Hope it helps.
    0
  • bloatedstoat
    Hey, first of all thanks for taking the time to reply despite not knowing the path you took to get to the solution, I get the drift of where you're coming from. It's a pretty convoluted way of getting something that, in my firm opinion, should work right out of the box on mail servers given the junk that hits mine every day, surely I'm not alone here. The blacklists are so effective though, particularly Barracuda, that I feel exposed without them. I'm loathe to spin up another box just to get this working but clearly I have two choices, do as you suggest or move from pDNS on our main server to Bind. Further contributions to this thread welcome. Thanks again SimpleTechGuy, appreciate the help. Cheers.
    0
  • cPRex Jurassic Moderator
    The short story from my end is that you have to be using non-public resolvers in order for the RBLs to work properly. Do you have those set in /etc/resolv.conf?
    0
  • SimpleTechGuy
    The short story from my end is that you have to be using public resolvers in order for the RBLs to work properly. Do you have those set in /etc/resolv.conf?

    Hi @cPRex, I was under the impression that you were NOT supposed to be using public resolvers...
    0
  • SimpleTechGuy
    BTW, @bloatedstoat, I forgot to mention that according to
    0
  • SimpleSonic
    Try editing: /etc/mail/spamassassin/local.cf At the end of the file add: dns_server 127.0.0.1 Then restart Exim: service exim restart
    0
  • cPRex Jurassic Moderator
    @SimpleTechGuy - you're correct, I just missed a word. You do NOT want public resolvers in that file if you want the RBL lookups to work. I'll edit my previous post.
    0
  • bloatedstoat
    Thanks for the help, I've used our data centre DNS in resolv.conf and this appears to have done the trick. Nice simple fix. Cheers.
    0
  • cPRex Jurassic Moderator
    I'm glad that's all it was!
    0
  • bloatedstoat
    • Edited

    Well, it's time to revisit this 3 years on. I ended up disabling the URIBL but they were so useful and I'd ideally like to get them operational again.

    Environment
    cPanel: 11.136.0.33
    OS: CloudLinux 8.10
    PowerDNS Authoritative: 4.9.16-1.cp130~el8
    ConfigServer MailScanner/SpamAssassin: used for inbound mail filtering
    cPanel nameserver: PowerDNS
    Previous configuration: BIND, with local caching/recursive DNS

    Problem
    After moving to PowerDNS Authoritative, the server now uses external recursive resolvers in /etc/resolv.conf:

    nameserver 202.130.45.45
    nameserver 101.0.120.146

    We understand that PowerDNS Authoritative does not provide recursive/caching DNS, so external resolvers are required.

    PowerDNS is currently listening on port 53 on all interfaces:

    udp   0.0.0.0:53
    udp   [::]:53
    tcp   0.0.0.0:53
    tcp   [::]:53

    The server's resolver configuration is:
    # Generated by NetworkManager
    search smartservers.com.au
    nameserver 202.130.45.45
    nameserver 101.0.120.146

    Testing against the first resolver shows that it does cache DNSBL responses:

    dig 2.0.0.127.zen.spamhaus.org @202.130.45.45

    The first query takes approximately 76 ms, while subsequent queries return in 0 ms and the TTL counts down from 60 seconds.

    The second resolver behaves similarly.

    We still see URIBL_BLOCKED despite DNSBL caching, perhaps the TTL is pretty low?

    cPanel's own documentation for URIBL_BLOCKED also states that if changing to appropriate local/data-centre resolvers does not resolve the issue, using our own recursive DNS servers may be necessary.

    Questions :)

    • What is the cPanel-supported/recommended configuration for this situation when using PowerDNS Authoritative?

    Specifically:
    Is it supported to run PowerDNS Recursor alongside cPanel's PowerDNS Authoritative server on the same CloudLinux/cPanel server?

    If so, is the recommended configuration to run PowerDNS Recursor on a separate local port/address, for example:

    PowerDNS Authoritative: 0.0.0.0:53
    PowerDNS Recursor:      127.0.0.1:5301


    and configure SpamAssassin/MailScanner to use the local Recursor?

    • Is there a cPanel-supported way to configure SpamAssassin/MailScanner to use a dedicated local recursive resolver without changing /etc/resolv.conf for the entire server?
    • Alternatively, does cPanel recommend switching the server back to BIND solely to provide the local caching/recursive resolver? I'd sooner not go down this road.
    • If PowerDNS Recursor is the recommended solution, which package/repository/version should be used on CloudLinux 8.10 with cPanel 11.136, and how should it be configured so that cPanel's managed PowerDNS Authoritative installation is not affected by cPanel updates?
    • Are there any cPanel-specific considerations regarding DNS zones hosted by the local PowerDNS Authoritative server when a separate PowerDNS Recursor is running locally?

    The recursive service would only need to be accessible locally (or otherwise tightly restricted), primarily for MailScanner/SpamAssassin DNSBL and normal outbound DNS resolution.

    We would appreciate guidance on the supported architecture and configuration, rather than simply switching back to BIND if there is a supported way to achieve the same functionality with PowerDNS.

    Thanks for any direction here.

     

     

     

     

    0
  • cPRex Jurassic Moderator

    This is fun - let me do some homework and I'll get back to you.

    1
  • cPRex Jurassic Moderator

    Would something like this work?

    https://support.cpanel.net/hc/en-us/articles/39603635822359-How-can-I-configure-SpamAssassin-to-use-a-custom-DNS-resolver

    It would let you choose a custom DNS resolver specifically for the SpamAssassin service to work around these issues.

    0
  • bloatedstoat

    Yes, partially!

    So the question is no longer really “How do I make SpamAssassin use a different DNS resolver?” — you've answered that, and thank you.

    The remaining question is:

    What resolver should we run locally, and is PowerDNS Recursor supported alongside cPanel's PowerDNS Authoritative server?

    That's the one I'd like to baton down now. Thanks.

    1
  • bloatedstoat

    As an addition to the above.

    URIBL's own documentation is explicit here: it says that if an ISP/shared resolver is affected, you can set up a caching nameserver on the loopback of the machine doing the spam checking and point DNS to localhost.

    One subtle point; the caching alone isn't necessarily sufficient, URIBL says its public mirrors are intended for low volume usage and that high volume mail systems may ultimately require its commercial Datafeed service. It goes on that caching can reduce query volume. If we can get this up and operational then it's just a matter of seeing whether our volume is within the expected free public mirror use case, rather than us assuming a local Recursor will solve every possible URIBL_BLOCKED situation.

    0
  • cPRex Jurassic Moderator

    That's the part I'm not sure I have a good answer for.

    99.9% of cPanel systems don't run into this issue, and if they do we have that workaround, so I just don't have any details on my end about running other tools alongside cPanel's PowerDNS.  You may be in uncharted territory at this point.

    0
  • bloatedstoat

    Okay, thank you cpRex.

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post