RblFilter Class
Provides methods to filter spam by checking e-mails and IP addresses against DNS RBL databases.
Inheritance Hierarchy
SystemObject
  MailBee.AntiSpamRblFilter

Namespace: MailBee.AntiSpam
Assembly: MailBee.NET (in MailBee.NET.dll) Version: 11.2.0 build 590 for .NET 4.5
Syntax
public class RblFilter : IComponent, IDisposable

The RblFilter type exposes the following members.

Constructors
  NameDescription
Public methodCode exampleRblFilter
Creates an instance of RblFilter class.
Public methodRblFilter(String)
Creates and unlocks an instance of RblFilter class.
Top
Methods
  NameDescription
Public methodAbort
Forces MailBee to cancel all pending operations and close all opened connections as soon as possible.
Public methodDispose
Closes opened network connections (if any) and releases any used system resources.
Protected methodDispose(Boolean)
When overridden in a derived class, must release unmananged and optionally managed resources used by the component.
Public methodEquals
Determines whether the specified object is equal to the current object.
(Inherited from Object.)
Protected methodFinalize
Allows an object to try to free resources and perform other cleanup operations before it is reclaimed by garbage collection.
(Inherited from Object.)
Public methodGetHashCode
Serves as the default hash function.
(Inherited from Object.)
Public methodCode exampleGetRblStatusesOfIPAddress
Gets the statuses of the given IPv4 address in the specified RBLs.
Public methodGetRblStatusesOfIPAddressAsync
Public methodCode exampleGetRblStatusesOfMailOriginatingIPAddress
Gets the statuses of the IP address the given e-mail originated from, in the specified DNS RBL databases.
Public methodGetRblStatusesOfMailOriginatingIPAddressAsync
Public methodGetType
Gets the Type of the current instance.
(Inherited from Object.)
Public methodCode exampleIsIPAddressInRbl
Checks if the given IP address is listed in the specified DNS RBL.
Public methodIsIPAddressInRblAsync
async/await version of IsIPAddressInRbl(String, String).
Public methodCode exampleIsMailOriginatingIPAddressInRbl
Checks if the IP address the e-mail was received from is present in DNS RBL database.
Public methodIsMailOriginatingIPAddressInRblAsync
Protected methodMemberwiseClone
Creates a shallow copy of the current Object.
(Inherited from Object.)
Protected methodOnDataReceived
Used by MailBee to raise DataReceived event.
Protected methodOnDataSent
Used by MailBee to raise DataSent event.
Protected methodOnErrorOccurred
Used by MailBee to raise ErrorOccurred event.
Protected methodOnLogNewEntry
Used by MailBee to raise LogNewEntry event.
Public methodResetState
Resets the internal state of the component.
Public methodToString
Returns a string that represents the current object.
(Inherited from Object.)
Top
Properties
  NameDescription
Public propertyDnsServers
Gets the DnsServerCollection object containing the list of DNS servers to be used for DNS RBL lookup.
Public propertyIsAborted
Indicates whether Abort method has been called for the component.
Public propertyIsBusy
Indicates whether the component is performing a lengthy operation.
Public propertyCode exampleLog
Gets the object used for logging MailBee activities into a file or memory buffer.
Public propertyMaxThreadCount
Gets or sets the maximum number of threads MailBee may create during RBL verification of IP addresses. operations.
Public propertyRaiseEvents
Gets or sets whether the component will raise any events.
Public propertySite
Gets or sets the object to be used as a site for the component.
Public propertySynchronizingObject
Gets or sets the object used to marshal the calls of the event handlers.
Public propertyTrialDaysLeft
Gets the number of days left to the date of the trial license key expiration.
Public propertyVersion
Gets the version of the MailBee assembly.
Top
Events
  NameDescription
Public eventCode exampleDataReceived
Occurs when data is received from the network.
Public eventCode exampleDataSent
Occurs when data is sent to the network.
Public eventDisposed
Occurs after the component was disposed.
Public eventErrorOccurred
Occurs when MailBeeException is thrown internally.
Public eventCode exampleLogNewEntry
Occurs when an entry is written into the log file (or into the memory buffer if RblFilter.Log.MemoryLog is true).
Top
Remarks

The methods of this class make DNS queries to RBL servers to check if a particular address is in blacklists. Multiple RBLs can be checked simultaneously, greatly improving performance.

If you don't know the IP address but have a mail message you want to check, you can also pass a MailMessage and MailBee will extract the originating IP address from Received headers.

Unlike BayesFilter class, this class doesn't require you to train the filter first, it's always ready for immediate use.

Popular RBLs you can use (although you're free to change or extend this list in any way):

  • zen.spamhaus.org
  • bl.spamcop.net
  • cbl.abuseat.org

Note Note
RBLs are third-party resources, they can block DNS requests from your machine for any reason (for instance, if you make too many queries daily or hourly). Moreover, some RBLs like Barracuda won't let you use them until you create an account in their system. It's recommended to keep volume of DNS queries as low as possible. For instance, you should disable DNS TCP and leave only DNS UDP. Also, MailBee by default caches earlier received results of checking IP addresses in DnsCache so it won't make another request if the given IP address has already been checked during the current session of your program.
Note Note
When passing DNS RBL host name, be sure to make no typos. The nature of DNS is that if you make a typo in RBL name, it will have an effect like there is no IP address in the given RBL but no error may occur. This is because there is no actual connection with any server occurs, RBL is purely DNS thing. Errors usually occur only if for some queries your DNS server time out for some reason.

You can combine using RBLs with Bayesian filter (BayesFilter class) or DKIM checks (e.g. DomainKeysVerify). It's also possible to check reverse DNS (PTR), MX records, SPF. Check "Filter spam with DNS queries (MX, SPF, DKIM, reverse DNS)" tutorial in Developer's Guide for more.

Examples

This sample checks an e-mail against popular RBLs (the e-mail is loaded from a file but could also be received from a mail server, the only requirement is that the message must have Received header from which MailBee will determine the IP address the message originated from).

The sample also fine-tunes DNS checking routine for better performance (at cost of lower accuracy). You can remove "For performance sake" section to return to default DNS settings.

This is multi-threaded (and faster) version of the sample from RblFilter topic.

using System;
using MailBee;
using MailBee.Mime;
using MailBee.DnsMX;
using MailBee.AntiSpam;

class Sample
{
    static void Main(string[] args)
    {
        RblFilter rbl = new RblFilter();

        // Logging is helpful for debugging.
        rbl.Log.Enabled = true;
        rbl.Log.Filename = @"C:\Temp\log.txt";
        rbl.Log.Format = LogFormatOptions.AddContextInfo; // Context info is useful in multi-threaded mode.
        rbl.Log.Clear();

        // RBL check needs DNS servers.
        rbl.DnsServers.Autodetect();

        // For performance sake, avoid making redundant TCP queries. UDP is enough with RBL.
        // Also, the default 5000ms timeout can be too long.
        foreach (DnsServer dns in rbl.DnsServers)
        {
            dns.TryTcp = false;
            dns.UdpTimeout = 500;

            // Or you can leave UdpRetryCount=2 (default), it will end up in increased times to check against dead/slow RBLs
            // but the results will be more accurate.
            dns.UdpRetryCount = 1;
        }

        // Multi-threaded mode. This sample will run faster than single-threaded version.
        rbl.MaxThreadCount = -1;

        // Grab some mail message to check. In production, you can get it from IMAP server or elsewhere.
        MailMessage msg = new MailMessage();
        msg.LoadMessage(@"C:\Temp\msg.eml");

        // Ask some popular RBLs about this message.
        RblStatusCollection statuses = rbl.GetRblStatusesOfMailOriginatingIPAddress(msg, 0,
            new string[] { "zen.spamhaus.org", "bl.spamcop.net", "cbl.abuseat.org" });
        if (statuses == null)
        {
            Console.WriteLine("Can't extract originating IP address from the e-mail");
        }
        else
        {
            Console.WriteLine("Is in RBLs: " + statuses.IsInRbls.ToString());
            foreach (RblStatus status in statuses)
            {
                Console.WriteLine(string.Format("RBL: {0}, IP found: {1}, RBL check resulted in error: {2}, RBL reply: {3}",
                    status.RblHost, status.IsIPAddressInRbl, status.IsError, status.RblReplyText));
            }
        }
    }
}
See Also