Direct to MX Spam blocking plugin

Introduction

Direct to MX spam is spam mail direct from a dialup-equivalent IP address to the mail server of the destination, without going through the outgoing mail server of the sender. Legitimate people tend to send mail through the mail server of their ISP. Spammers don't.

These plugins block mail if the IP address on the first Received line is on a dialup-equivalent list. Dialup-equivalent is dialup, dynamic cable and dynamic DSL.

SpamPal uses some of the same services but it is set not to accept these results as spam. That's necessary for SpamPal because it checks the second and later Received lines and most mail from dialup, cable and DSL customers will have a dialup-equivalent IP address somewhere.

Warnings

Your IP address ignore list is not currently used by this plugin.
Some ISPs do not add a second received line for mail from one customer to another. You must add the IP addresses of your own ISP to the SpamPal advanced whitelist to avoid this risk. This will also speed up normal mail by eliminating some normal DNSBL lookups. You can get these IP addresses by sending yourself few test emails.
Sometimes legitimate users send directly to the MX address of the destination. This happens mainly in two cases:
- Companies using this as a fallback when their main address is down. These will useuslly be at fixed addresses and the company can get its fixed IP excluded from the dialup-equivalent list.
- Mobile computer users who have no provider which will let them send mail while traveling,
Mail from either will be treated as spam if the IP address is on a dialup-equivalent list. The best solution for these issues is a good whitelist to protect your regular senders.
If you have your mail relayed on receipt, don't use this because it won't do any good. Your receiving relay will replace the first Received line, making this useless.

Installation:

Create a folder called mxblocking in the SpamPal plugin directory and copy all of the files in this zip into that folder. When you use the standard installation folder on Windows 9X it should be: C:\Program files\SpamPal\plugins\mxblocking

Now turn on the plugin in the SpamPal plugin settings page and use the Properties button to select which blacklists to use. If you have the earlier version with the plugins for each blacklist in their own directory you should delete those now.

DNSBL details

See http://www.njabl.org/use.html for details of the MXNJABL DNSBL used. Only the 127.0.0.3 dialup/dynamic result is used.
See http://relays.osirusoft.com/faq.html for details of the MXOSIRU DNSBL used. Only the 127.0.0.3 dialup-equivalent result is used. As of 2003-8-28 it appears to have ceased operation. Until this changes, you must turn it on by hand every time you start SpamPal.
See http://www.pan-am.ca/pdl/ for details of the MXPANAM DNSBL used. Only the 127.0.0.2 dynamic result is used. That's the only result from this DNSBL.
See http://dynablock.easynet.nl/errors.html for details of the MXEASYN DNSBL used. Only the 127.0.0.2 dynamic result is used. That's the only result from this DNSBL.
See http://www.dul.ru/dul.en.html for details of the DulRu DNSBL used. Only the 127.0.0.1 result is used.
See http://www.leadmon.net/spamguard/ for details of the Leadmon.Net DNSBL used. Only the 127.0.0.2 dialup-equivalent result is used.

If a blacklist changes location or result code you can edit config.dat with Notepad to update the settings for that DNSBL.

Source Code

Source code for this plugin is included. Unzip into subdirectories to get the Microsoft DevStudio 6 source. The license for these is the same as the SpamPal 1.26 license with one addition: you may not use these to offer a service bureau for others without contacting me for a license. Use in your own company or institution for its own mail or for your own household is fine. So is use for others with no revenue source at all - no ads, no payments, not in association with a for-fee product.

Changes:

Version 0.0.8

Added the Leadnet dialup-equivalent list.
Disabled relays.osirusoft.com settings load, so it can't be turned on for more than a single session.

Version 0.0.7

Added the Easynet dialup-equivalent list.
Fixed a bug which would add harmless 0.0.0.0 IPs to the config.dat file.

Version 0.0.6

Added dul.ru as a dialup DNS service.
Turned off thread start notification to speed up SpamPal threading.

Version 0.0.5

Minor tweak to improve SpamPal performance: changed getPluginCapabilities for headers from CAN_DETECT_SPAM | CAN_DNSBL_QUERY_SPAM to just CAN_DNSBL_QUERY_SPAM.

Version 0.0.4

Version 0.0.3 always made every query. This one fixes that bug.

Version 0.0.3

Combined the three plugins into one and added support for the SpamPal plugins information panel.

Version 0.0.2

Light refresh adding debug logging version to the distribution and updating the readme with cautions about adding your incoming mail server to the SpamPal advanced whitelist.