NAME

blq - Inquire an email block list server.

SYNOPSIS

blq -at [list-id-or-zone[, ...]] host-name-or-address

DESCRIPTION

Several organizations publish mail abuse lists via DNS. blq inquires those lists to determine if a particular host is present.

The list-id-or-zone selects which list to query. It may be the full DNS zone of the block list (such as ``blackholes.mail-abuse.org''), one of a number of pre-defined IDs (see below), or a list (comma or space delimited) of these items.

As distributed, the pre-defined set of IDs includes:


 List-Id        List-Zone
 -------        --------------------

 sbl            sbl.spamhaus.org
 rsl            relays.visi.com
 pdl            dialups.visi.com
 ordb           relays.ordb.org
 njabl          dnsbl.njabl.org
 xbl            xbl.selwerd.cx
 fiveten        blackholes.five-ten-sg.com
 spamcop        bl.spamcop.net
 hil            hil.habeas.com


 opm            opm.blitzed.org (combines the following lists)
 opm-wingate    wingate.opm.blitzed.org
 opm-socks      socks.opm.blitzed.org
 opm-http       http.opm.blitzed.org
 opm-all        (all the opm.blitzed.org zones)


 relays         relays.osirusoft.com
 dialups        dialups.relays.osirusoft.com
 spamsites      spamsites.relays.osirusoft.com
 spamhaus       spamhaus.relays.osirusoft.com (alternate feed of SBL)
 spews          spews.relays.osirusoft.com
 blocktest      blocktest.relays.osirusoft.com (not for filtering)
 outputs        outputs.relays.osirusoft.com
 osirusoft      (all osirusoft.com zones, except blocktest)

 dsbl-list      list.dsbl.org
 dsbl-multihop  multihop.dsbl.org
 dsbl-unconfirmed unconfirmed.dsbl.org
 dsbl           (all dsbl.org zones)


 rbl            blackholes.mail-abuse.org
 dul            dialups.mail-abuse.org
 rss            relays.mail-abuse.org
 maps           (all mail-abuse.org zones)


 all            (all the above)
 default        sbl, rsl, pdl, opm and relays

If no list-id-or-zone is specified, then default is used.

The host-name-or-address is the query to perform, specified either as a name or IP address. All the block lists are indexed by host address, not name. Thus, when a host name is given, it must be (and will be) resolved to an address for the query.

If a name resolves to multiple addresses, they all will be queried.

The output contains three colon-delimited fields, and looks something like:

 blackholes.mail-abuse.org : 192.168.117.89 relay.spamhausen.com : BLOCKED

The first field lists the zone queried. The second field lists the query: the host address followed by the name it resolves to. The third field lists the result: ``BLOCKED'' if the host is on the list, ``ok'' if it isn't.

The following options are available:

-a: Some block lists provide additional information on a listed entry. This information is encoded as an IP address. The -a option displays the address codes encountered for blocked entries.
-n: Normally, when the target is specified as an address, a reverse lookup is performed to determine the hostname. When -n is specified the reverse lookup is suppressed, and just the numeric address is displayed.
-t: Some block lists provide additional information in TXT records. If the -t option is specified, blq will fetch any TXT records associated with a list entry. The information found will be printed on subsequent lines, indented one tabstop.

DIAGNOSTICS

An exit status of zero indicates the host was not listed (``ok''). An exit status of two indicates that it was listed (``BLOCKED''). Any other non-zero exit status is an error.

BUGS

Inclusion of a particular list in this utility should not be construed as an endorsement by the program author. I use some of these lists for email filtering. I believe some of these lists are evil. You should visit their web pages, read their policies, and decide for yourself.

AUTHOR

 Chip Rosenthal
 <chip@unicom.com>