RBL spam filtering software

Realtime Blackhole List
or
Realtime Black List (RBL)

A real time blackhole is a server that accepts queries about the source of an email. These servers can be free - open for public use, or they can be commercial. When any email server tries to deliver an email to your server, your server takes note of the IP address of the sending server, and queries the RBL to see if that IP address is a known spammer in need of filtering out.

Since the RBLs are maintained, listing the IP addresses of known spammers, it will return true if the IP address queried is on its list. Likewise false is returned if it is not. True or false are very simplistic terms used to make the description clear. RBL servers actually operate just like DNS servers. If you query an RBL and no record is found, that's a false. Likewise, if a record is returned, then that's a true, or a strong indication that a spam is headed your way.

This may sound like a terrific solution to the problem, but again, there are downsides, and RBLs are only a tool in an overall anti spam strategy. RBLs, at least public ones can be notoriously inaccurate. There's hardly an IP address or domain name out there that doesn't hit on at least one of the more obscure RBLs out there, resulting in a false positive.

Likewise, many times, the source of a spam is not listed in an RBL, and you wind up with a false negative. Having not used commercial RBL servers in they past, I can only speculate that they should be a lot more accurate than the freely available public RBLs. Also, with viruses and other programs hijacking desktop computers to send spam, it can be next to impossible for any RBL administrator to stay on top of the sources of spam.

Usually, an administrator will use a small handful of RBLs that he trusts. And instead of a simple go-no-go test, it is preferable to add points to the overall spam score of any email hitting on some subset of the RBLs that you use to query.

All of this underscores the idea that it is critical that you guard against being an open relay. If your email server allows open relay, then you are a spammer, and you will wind up on one or more RBLs. How would that look if an important client never receive that very important email because your IP address is listed in the RBLs?