intellexapps / blcheck

Test a mail server against blacklists.

blcheck

A powerful script for testing a domain or an IP against mailing black lists. Script will use dig if it is found. If dig is not found script will use host.

Features

• More then 100 black lists already included!
• Automatic distinction between domain or IP
• Performs PTR validation (only if domain is supplied, does not work for IP)
• 3 verbose (-v) levels and a quiet (-q) mode
• The result of script is the number of servers which blacklisted the domain, so it can be used for any kind of automated scripts or cronjobs
• Informative and pleasant output

Requirements

• Any Unix/Linux with POSIX shell.
• Either dig or host command available.

Usage

blcheck [options] <domain_or_IP>

Supplied domain must be full qualified domain name. If the IP is supplied, the PTR check cannot be executed and will be skipped.

-d dnshost  Use host as DNS server to make lookups
-l file     Load blacklists from file, separated by space or new line
-c          Warn if the top level domain of the blacklist has expired
-v          Verbose mode, can be used multiple times (up to -vvv)
-q          Quiet modem with absolutely no output (useful for scripts)
-p          Plain text output (no coloring, no interactive status)
-h          The help you are just reading

Result of the script is the number of blacklisted entries. So if the supplied IP is not blacklisted on any of the servers the result is 0.

TODO

1. Handle domains with multiple DNS entries.

Licence

MIT License

Copyright (c) 2018 Intellex

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Credits

Script has been written by the Intellex team. Contributors: Darko Poljak

blcheck's Issues

dig throws error

Hey!

Firstly, thank you for maintaining this awesome tool... it saves me a hell of a hard time...

Lately I've been seeing this (ever since the update of 17th this month i believe):

[ \ 100% ] checking... 1 / 1 /usr/bin/dig: '81.200.248.178.0spam-killlist.fusionzero.com\n0spam.fusionzero.com\naccess.redhawk.org\nall.rbl.jp\nall.spam-rbl.fr\nall.spamrats.com\naspews.ext.sorbs.net\nb.barracudacentral.org\nbackscatter.spameatingmonkey.net\nbadnets.spameatingmonkey.net\nbb.barracudacentral.org\nbl.drmx.org\nbl.konstant.no\nbl.nszones.com\nbl.spamcannibal.org\nbl.spameatingmonkey.net\nbl.spamstinks.com\nblack.junkemailfilter.com\nblackholes.five-ten-sg.com\nblacklist.sci.kun.nl\nblacklist.woody.ch\nbogons.cymru.com\nbsb.empty.us\nbsb.spamlookup.net\ncart00ney.surriel.com\ncbl.abuseat.org\ncbl.anti-spam.org.cn\ncblless.anti-spam.org.cn\ncblplus.anti-spam.org.cn\ncdl.anti-spam.org.cn\ncidr.bl.mcafee.com\ncombined.rbl.msrbl.net\ndb.wpbl.info\ndev.null.dk\ndialups.visi.com\ndnsbl-0.uceprotect.net\ndnsbl-1.uceprotect.net\ndnsbl-2.uceprotect.net\ndnsbl-3.uceprotect.net\ndnsbl.anticaptcha.net\ndnsbl.aspnet.hu\ndnsbl.inps.de\ndnsbl.justspam.org\ndnsbl.kempt.net\ndnsbl.madavi.de\ndnsbl.rizon.net\ndnsbl.rv-soft.info\ndnsbl.rymsho.ru\ndnsbl.sorb' is not a legal name (ran out of space)

and that's it nothing else is done...

system is Centos 7, fully upgraded...

Cheers!

License

Hi,

What is the license of blcheck ?

Best regards

Yellow listed is mark as blacklisted

Hi,

I have got one IP which are yellow listed, but blcheck give a false blacklist reply :

xx.xx.xx.xx.xx is Yellow listed - This is a good listing. It keeps you from being blacklisted.
Yellow means that your IP contains no information as to whether or not it is spam. Yahoo, Google, and Hotmail are Yellow Listed.

----------------------------------------------------------
hostkarma.junkemailfilter.com : 127.0.0.3                 
                                                    
----------------------------------------------------------
Results for smtp-04.xxx.xxx.xxx.xxx.fr

Tested:        117
Passed:        116
Invalid:       0
Blacklisted:   1

Unable to interpret results

Hi,

I ran the script on a domain and it concluded with 2 blacklisted.

1. Does 2 blacklisted refer to the 2 lines of gremlin.ru?
2. Are the 2 lines of gremlin.ru: 127.0.0.2 considered valid?
3. What are the 2 lines trying to say actually?

vote.drbl.gremlin.ru : 127.0.0.2
work.drbl.gremlin.ru : 127.0.0.2

----------------------------------------------------------
Results for xxxxxxxx

Tested:        117
Passed:        114
Invalid:       1
Blacklisted:   2
----------------------------------------------------------

Email Notification

hello, how about implementing the option to send email when an ip is found blacklisted or not?
and how about set the script to run once per week with a cronjob or something..?

IPv6 support

Hi !

Thanks for this great tool, it does exactly what I was looking for :)

Would there be any way to implement IPv6 support ?

I'm not too worried about the detection itself (we can find/make a decent regex to detect IPv6 inputs), more about the blacklists themselves :

• Do they maintain IPv6 blacklists ?
• Is the querying mechanism different ?
• It this gonna make some of them consider the input as invalid ?

Anybody has any thoughts, or even tried it so far ?

Invalid blacklist for hostkarma.junkemailfilter.com

Hi,
the result we have for BL hostkarma.junkemailfilter.com is the follow:
hostkarma.junkemailfilter.com blacklisted (127.0.1.1)

In this doc:
http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists#No_Blacklist_List

127.0.1.1 means no BL (nobl listed - not a spam source - do not blacklist - maybe whitelist)
So seems that blcheck returns the wrong value.
You can check with:
blcheck -p 185.152.70.137

regards
emiliano

What is the purpose of -d option?

I'm trying to make this script compatible with IPv6, so I just need to understand one last thing, what is the purpose of the -d option?

-bash: blcheck: command not found

problem with shebang

some syntax in the script is incompatible with /bin/sh, e.g. ${} or $()

shebang has to be something like /bin/bash

--- a/blcheck
+++ b/blcheck
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash

Spamhaus error codes treated as blacklist

https://www.spamhaus.org/news/article/807/using-our-public-mirrors-check-your-return-codes-now.

The following results indicate an error:

• 127.255.255.252
• 127.255.255.254
• 127.255.255.255

These should not be treated as if the input IP is on the blacklist.

xargs or gnu parallel for parallel processing

would be nice to run multiple digs at once, to the capacity of the server. the loop for the blacklist would need to be functionized and then passed to either parallel or xargs

Running it through ip block

I have couple of /22 ip block. Would it be possible to modify it to support ip block and then dump a summary?

Shellcheck found a lot of problems

Shellcheck is a linter for shell scripts, that helps avoid undesired behaviours.

Here's the output against master.
https://gist.github.com/vsviridov/da9a253f214bf25923a3

Doesn't work

It seems the script consider the whole black list as only one entry...
I'm using bash 4.4.19 if that matters, on a fairly uptodate gentoo/linux computer. Really nothing special there.

(i got the same error if forcing the script to use 'host' instead of 'dig')

orzel@berlioz orzel/clones/blcheck% ./blcheck xxxx
[ \ 100% ] checking... 1 / 1 /usr/bin/dig: '244.38.64.82.0spam-killlist.fusionzero.com\n0spam.fusionzero.com\naccess.redhawk.org\nall.rbl.jp\nall.spam-rbl.fr\nall.spamrats.com\naspews.ext.sorbs.net\nb.barracudacentral.org\nbackscatter.spameatingmonkey.net\nbadnets.spameatingmonkey.net\nbb.barracudacentral.org\nbl.drmx.org\nbl.konstant.no\nbl.nszones.com\nbl.spamcannibal.org\nbl.spameatingmonkey.net\nbl.spamstinks.com\nblack.junkemailfilter.com\nblackholes.five-ten-sg.com\nblacklist.sci.kun.nl\nblacklist.woody.ch\nbogons.cymru.com\nbsb.empty.us\nbsb.spamlookup.net\ncart00ney.surriel.com\ncbl.abuseat.org\ncbl.anti-spam.org.cn\ncblless.anti-spam.org.cn\ncblplus.anti-spam.org.cn\ncdl.anti-spam.org.cn\ncidr.bl.mcafee.com\ncombined.rbl.msrbl.net\ndb.wpbl.info\ndev.null.dk\ndialups.visi.com\ndnsbl-0.uceprotect.net\ndnsbl-1.uceprotect.net\ndnsbl-2.uceprotect.net\ndnsbl-3.uceprotect.net\ndnsbl.anticaptcha.net\ndnsbl.aspnet.hu\ndnsbl.inps.de\ndnsbl.justspam.org\ndnsbl.kempt.net\ndnsbl.madavi.de\ndnsbl.rizon.net\ndnsbl.rv-soft.info\ndnsbl.rymsho.ru\ndnsbl.sorbs.' is not a legal name (ran out of space)

---

Results for xxx

Tested: 1
Passed: 1
Invalid: 0
Blacklisted: 0

Remove nszones.com

please see https://www.spamhaus.org/organization/statement/008/fake-dnsbl-uncovered-nszones.com

multiple "not found"

Hello,

Simply runnig your script and have 3 warnings :

./blcheck: 176: ./blcheck: [[: not found
./blcheck: 321: ./blcheck: shopt: not found
./blcheck: 327: ./blcheck: [[: not found
Warning: PTR record does not match supplied domain: test1.net != ns.test1.net

---

Results for test1.net

Tested: 117
Passed: 117
Invalid: 0
Blacklisted: 0

error 321 related to shopt binary, but I've got it in my path.

Regards