Want to use MailPolice? See Usage Notes
mar 30 2007:
In order to keep our lists available to everyone (and manage our bandwidth costs), we have begun blocking servers with high usage numbers. If
MailPolice RHS is no longer working for you, please subscribe to our rsync service.
mar 15 2006:
porn.rhs.mailpolice.com is NO LONGER part of the block list. The block list now contains the bulk and
fraud lists.
mar 14 2006:
rbldns zone files have been reduced by 50% by using features supported by rbldnsd 0.98+.
TXT records have also been re-activated for each zone.
may 17 2005:
New lists: adult, redir
porn.rhs.mailpolice.com has been split into two lists: porn and adult lists. See below.
apr 23 2005:
MailPolice rsync server has been upgraded, and has a new host key. If you get zones via rsync, you may get a SSH warning. It is safe to accept the new key.
nov 12 2004:
MailPolice fraud data has been combined with the SURBL phishing data source. See below.
may 6 2004:
New lists are available. See below.
See the changelog
what is mailpolice?
MailPoliceTM provides e-mail security. E-mail is scanned for viruses and spam
using our proprietary algorithms developed over 3 years of spam interception.
Please visit the MailPoliceTM website for more information.
To implement RHS lookups on your SMTP server, see the RHS usage page.
what is rhs.mailpolice.com?
MailPoliceTM maintains a domain-based list of domains which have been (ab)used to send spam to our customers. There are currently several domain-based lists: one which lists bulk mail senders and unsolicited advertisers; pornographic e-mailers and websites; reverse DNS hostnames of dynamic Internet connections; websites and IP's hosting fraudulant or phishing content; legitimate e-mail marketers and opt-in advertisers; and domains used by webmail providers.
what is the point of a domain-based list? what's wrong with an ip-rbl?
Judging e-mail based on the MAIL-FROM or hostname of the connecting mail server or websites advertised within an e-mail, is effective. Many unsolicited e-mailers regularly buy domains for the sole purpose of spam. No matter where the spam is sent from, it can be blocked based on the senders' domain name, or the domain name used in advertising URLs in the body of the e-mail.
Blocking based on IP address is effective only as long as the spammer continues to send from these IP addresses, it does not take into consideration that spammers can quickly move to another set of IP addresses, or use unlisted proxies.
Using a combination of domain-based and IP-based blacklists is an effective weapon against spam.
how do domains get listed?
Offending domains can be listed within an hour of detection.
We collect real-time statistics of e-mail FROM domains and URLs advertised within e-mail. If the domain is located on an IP used for unsolicited e-mail, or has sent a large amount of e-mail in a short time, or has been registered by a spam-supporting domain registrar, the domain will be listed automatically.
can i check if a domain or ip is listed?
Yes, by a DNS query (see below).
Or, you can perform an online lookup.
*NEW* how can i implement rhs lookups in my smtp server?
This page shows several methods for implementing RHS lookups in your SMTP server software.
is there an ip-rbl list?
MailPoliceTM maintains a Realtime BLackhole of IPs which have been (ab)used to send spam to our customers. There are currently two IP-RBL lists: one which lists known spam offenders, and one which lists SMTP/HTTP open relay proxies.
Note, the rbl.mailpolice.com IP-RBL lists are not currently available.
why is my domain or ip listed?
A domain is only added to the domain-based lists bulk and fraud, should it be involved in sending any unsolicited mail to our customers. This includes, the domain used in the Right-Hand Side of the MAIL FROM: or advertised as a URL in the message body. If the domain relates to pornography, it gets listed in the porn.rhs.mailpolice.com list, otherwise it gets listed in the bulk.rhs.mailpolice.com list. A domain can be listed in both lists, for instance, if a porn website sends unsolicited e-mail.
Domains need not send unsolicited e-mail to be listed in the domain lists adv, porn, adult, webmail or redir. These lists are simple classification databases that can be used to determine what kind of e-mail content users would like to receive. These lists can also be used with domain proxy URL filters to block web content.
why isn't domain xyz or ip listed? i always see spam from there.
In order to prevent collateral damage, we only list a domain or IP if it's safe to do so.
- Domains associated with webmail sites, although abused heavily, should not be listed.
- Domains associated with some semi-legtimate commercial bulk mailers, should not be listed.
- Domains beloning to ISP's or web hosting providers, should not be listed.
is it possible that an innocent domain gets listed?
A domain is only added to the domain-based lists after some investigation. A domain name is not added "just because" it appears in an e-mail. This should provide some protection against malicious joe-jobs.
We are always refining our domain election process to avoid against false-positives and accidental additions. Should your domain be accidentally listed, please contact us to remove it!
An IP is only added to the IP-based lists should it be involved in actually connecting to our mail server to send unsolicited mail to our customers, or hosts spam-advertised content.
how do i get my domain or ip removed?
If asked, we will remove your domain or IP address, no questions asked. Please, fill out the form here for immediate removal. If you need help securing your server, we are more than happy to help! Just send us mail.
However, a domain will be re-listed if it's been involved in a re-offense.
you are blocking my mail!
We provide these lists for other system administrators to use as a resource, it's up to them how they use it.
The MailPoliceTM mail system does not arbitrarily block mail. A number of steps determine whether or not mail should be blocked. We try our best not to list legitimate sites. If yours is, we can remove it.
are these lists publically available?
Yes, the domain-based lists can be used freely at this time. We merely ask you mention MailPolice.com on your website. You can use the graphic buttons below if you like.
These lists can be used to block e-mail:
The following lists should never be used to block e-mail in site-wide configuations, because legitimate e-mail will be blocked. It is recommended for per-user configurations only!
Please note that none of these lists, with the exception of fraud, contain IP addresses, only domain names.
Queries can be made in the form example.tld.bulk.rhs.mailpolice.com where example.tld is the domain name to check. All entries return 127.0.0.2.
The lists can be tested by querying for example.tld.
TXT records are no longer available. Listing date can be obtained by doing an online lookup on the domain name.
Zone-transfers are not supported.
rsync transfers are now available by request for legitimate e-mail servers that process more than 10,000 e-mails per day. The process involves generating a private key for login to our master server, and rsync to download updates. Our zone files are currently available in rbldnsd format only for mail servers that handle 100,000+ emails per day.
bulk.rhs.mailpolice.com
This is a general list of domains involved in sending unsolicited bulk e-mail, and URLs contained within unsolicited e-mail.
porn.rhs.mailpolice.com
List of pornographic (sexually-explicit, 18+) websites and e-mailers. This includes websites and e-mailing domains which depict sexuality, nudity with sexual themes, fetishes, escort services, links to other pornographic sites, adult search engines, adult dating, or contain pornographic advertisements. Nearly 100 new domains are listed every day. Please note, that some legitimate pornographic mailing lists and adult-oriented websites WILL be listed. If you or your users have signed-up for sexually-explicit newsletters, then this list will certainly block them. A listing on this list does NOT constitute a spam source.
fraud.rhs.mailpolice.com
Domains and IPs involved in fraudulant activity, commonly referred to as "phishing". These sites appear in e-mail disguised as important notices from financial institutions (PayPal, EBay, banks), requesting credit card numbers or logon information. Using this list is highly encouraged when matching URLs inside an e-mail message.
As of November 12 2004, fraud.rhs.mailpolice.com has been merged with the SURBL phishing list.. If you use the SURBL "ph" data source, you can discontinue using fraud.rhs.mailpolice.com.
block.rhs.mailpolice.com
A consolidate listing for bulk.rhs.mailpolice.com, and fraud.rhs.mailpolice.com. If you choose to use these two lists together, please use block.rhs.mailpolice.com instead.
dynamic.rhs.mailpolice.com
Reverse DNS hostnames of dynamic PPP/DSL/cable Internet connections, useful for stopping spam from broadband proxies. It should be unlikely that these block any legitimate mail servers. This data was collected by examining connections from open-proxies. A listing on this list does NOT constitute a spam source.
adv.rhs.mailpolice.com
Domains used by e-mail marketers. This includes legitimate opt-in subscription mailing lists and newsletters. This list should never be used to block e-mail in site-wide configurations! It will surely block legitimate and important e-mail that users have opted-in to receive. This should only be used by user-configurable filters to block advertising, or possibly as a white-list for people who wish to receive solicited advertising. A listing on this list does NOT constitute a spam source.
webmail.rhs.mailpolice.com
Domains used by webmail providers. Like hotmail.com and yahoo.com. This will block legitimate e-mail. Only use for tagging e-mail as coming from a webmail service, or to block mail for users who don't want to receive mail from webmail addresses (corporate environments, perhaps). This can work very well, for example, in conjunction with other tests to verify that e-mail came from a legitimate webmail service, or to counteract the effects of another blacklist that accidentally listed a heavily abused webmail domain. A listing on this list does NOT constitute a spam source.
adult.rhs.mailpolice.com (new)
List of adult-oriented (but not exclusively pornographic) websites. This includes adult online stores, dating sites, joke sites, blogs, adult portals, adult/erotic stories, sites that include adult advertisements or links to other adult sites, and other adult-themed sites which do not necessarily have pornography as the primarily focus. Since these sites are not sexually-explicit, you may not wish to block email that mentions them. A listing on this list does NOT constitute a spam source.
redir.rhs.mailpolice.com (new)
Websites which redirect to another website. This includes any website which provides an open mechanism to redirect a web browser to another website, ie, by adding a url=http://anotherwebsite in the URL. This will block legitimate e-mail. Only use for tagging whether e-mail contains links to a redirecting website, or in conjunction with other tests. A listing on this list does NOT constitute a spam source.
linking to mailpolice
If you use a MailPoliceTM list, we kindly ask you provide a link (like the one above) to our website by using the following HTML code:
<a href="http://www.mailpolice.com"><img src="http://rhs.mailpolice.com/dnsblocklist.gif"
alt="MailPolice.com Blocklist" border=0></a>
guarantee
These lists are being made freely available to help other mail server administrators stop spam. Currently there is no charge to access this resource, but this may change in the future, to help finance the ongoing maintenance and development of our technologies. There is absolutely no guarantee that these lists will always be available. The list contents are based on our own observations and should not be interpreted as anything malicious.
copyright
MailPolice RHS domain lists are available freely for your own use. You may not copy, reproduce, republish, post, transmit, distribute or modify in any way, all or in part. These compilations are copyright © 2002-2008 MailPolice, a product of Nebularis Information Systems Incorporated. All rights reserved.
If you use MailPolice lists, help keep it free by making a donation to help cover operational costs:
See the changelog
|
