Is anybody running their own realtime blacklist or blocklist of any type on Linux that is queried by their internal mail servers? For example, server A runs the blocklist service but no mailer and servers B, C, D and E all point to A to validate an inbound message before accepting the message?

What are you trying to accomplish ? might make it easier to find an answer...

Blacklisting for Spammers ? Blacklisting websites ? are you trying to prevent users from going places or are you wanting to provide a blacklisting service to others ?

My mailserver is using blacklists to block spam, and a product such as Dansguardian on Linux can make use of lists to block websites..

My domains receive literally 10's of thousands of spam per day. The spam is easy to identify because the spam is sent to nonexistent users.

Since the mail servers these days have the option to point to a blocklisting service I figured I could set up my own blocklist service for internal purposes, and block these spam hosts by origin IP.

I've looked at the external blocklisting services and in most cases they block IP ranges I communicate with so I want to take the blocklist service under my own control.

Not sure what mail server you use, I run postfix. I can blacklist right in the postfix config, as well as utilize many many other UCE (unsolicited commercial email) blocking features that are simple to implement, reject mail to unknown users, reject mail from servers that do not resolve using rdns, etc.. etc.. on top of that I use Spamassassin to inspect messages and tag those that look like spam. SA also can use Black Lists, custom lists etc..

so if nothing else take a look at spamassassin. http://spamassassin.apache.org/

I would also be surprised if all the black lists contain addressess you communicate with, I use about 6 different black lists on my servers. unless you receive mail from asia, and people that host mail on Dynamic IP addressess and people that send valid mail through open relays (no such thing as valid mail through open relays imho) there are definately Black lists you can use to block some of that junk. I reject about 60-70% of all mail that touches my server through black lists and other tests.. then it gets filtered through SA and gets tagged.

It gets examined and tagged again when users retrieve it by a commercial device I purchase from Fortigate.. I have had very few complaints about valid mail being blocked. most people ask if I can make it tighter to block more.. if they only knew the percentage I block vs what makes it to their mialboxes..


Well heres some Black lists you can review to find one or several that suit your needs.. read up on their policies for adding and removing people first to make sure their methods agree with you...
http://www.declude.com/Articles.asp?ID=97

I use some of the following lists

sorbs - some not all
spamcop
spamhaus - some not all
ordb

Best of luck in your battle...

Thanks for the info farslayer. Do the products you mention allow you to have other mailhosts on your network query the blacklist you defined in your postfix config? I've updated my original post to hopefully better reflect the concept.

I think what I'm after is a how-to on setting up a centrally located blocking server service that my other mail servers can query, not route through.