RBL

DNS RBL integration

What it does #

Queries DNS blackhole zones (example zen.spamhaus.org) for listed IPs. Optional auto-block. Results cached.

Edition #

SHARED. Enterprise writes may be license-gated.

Prerequisites #

• Manager DNS resolution to the RBL zones (and permission to query them)
• Admin JWT
• Understanding of the RBL provider’s acceptable-use policy

Required permissions / credentials #

• Recursive DNS or listed dns path; some RBLs require a commercial query key (not a Zwall product — configure only zones you may use)
• No Zwall-side RBL username in code beyond zone names

Configuration #

security.rbl.*: enabled, sources[] (name, zone, enabled, description), check_interval, cache_ttl, cache_size, auto_block, block_duration, whitelist, max_concurrent_checks.

Setup #

1. Enable RBL and add zones you are allowed to query.
2. Restart Manager.
3. POST /api/v1/security/rbl-check with an IP you control in lab, or GET /api/v1/security/rbl-results/:ip.
4. GET /api/v1/security/rbl-stats.

Verification #

• Stats increment
• Whitelisted IPs skip checks
• Auto-block (if enabled) creates a temporary block with configured duration

Expected signals / results #

RBL hits may appear in security logs / notifications if notify-on-block is wired for that path.

Failure modes #

Troubleshooting #

• dig the same zone from the Manager host
• Lower concurrency
• Confirm whitelist CIDRs

Security considerations #

RBL answers are third-party. Auto-block can deny legitimate NAT. Respect provider ToS (Spamhaus and others restrict high-volume queries).

Limitations #

• Not an email MTA
• Cache TTL can delay listing/delisting
• No published query QPS

Related #

• API security
• Manager configuration