This article applies as of PRTG 26
Checking for IP addresses on blacklist servers
The IP on DNS Blacklist and IP Reputation Score sensors check the IP address of the parent device against blacklist servers (DNSBL). If the IP address of the parent device appears on a DNSBL configured in the sensor settings, the sensor enters the Warning status.
IP on DNS Blacklist sensor
With each scanning interval, the IP on DNS Blacklist sensor queries all servers that you entered in the sensor settings. In our tests, 50 DNSBLs with a 5-minute scanning interval worked fine. Values in your network might vary, depending on the connection speed and availability of servers.
We recommend that you do not enter more than 10 servers to make sure that the sensor can complete the check within its scanning interval.
If you use too many DNSBLs, the sensor shows this error message:
Your request has timed out. Depending on the sensor type you use, the reason might be that the sensor could not connect to the target host or that a PowerShell command takes too long to execute. For more information, see https://helpdesk.paessler.com/en/support/solutions/articles/76000042368 or https://helpdesk.paessler.com/en/support/solutions/articles/76000063353. (code: PE018)
IP Reputation Score sensor
The IP Reputation Score sensor is the successor to the IP on DNS Blacklist sensor. The sensor itself requires less resources. As a result, you can query up to 100 DNSBLs without significant impact on performance.
You also have the ability to assign scores to different blacklist servers. A score is a way to give specific blacklist servers more weight, for example, if you trust their reliability.
The sensor has a Score channel, which is the sum of all the assigned scores of DNSBLs where the IP address was found. For example, If you assign all your servers a score of 1 and the sensor finds your IP address on three of the servers, then the channel shows a value of 3. You can assign scores and adjust the channel limits to be less sensitive, giving you more control on when your sensor enters the Warning status.
List of blacklist servers
These DNSBLs have historically worked with PRTG. Please let us know if you encounter issues with any of the DNSBLs listed.
- all.s5h.net
- b.barracudacentral.org
- bl.blocklist.de
- bl.mailspike.org
- bl.score.senderscore.com
- bl.spamcop.net - Both sensors use this server as the default.
- bl.spameatingmonkey.net
- dnsbl-1.uceprotect.net
- dnsbl-2.uceprotect.net
- dnsbl-3.uceprotect.net
- dnsbl.dronebl.org
- dnsbl.justspam.org
- dnsbl.kempt.net
- ips.backscatterer.org
- korea.services.net
- mail-abuse.blacklist.jippg.org
- psbl.surriel.com
- spam.pedantic.org
- spamsources.fabel.dk
- tor.dan.me.uk
- truncate.gbudb.net
Note: The IP on DNS Blacklist and IP Reputation Score sensors follow RFC 5782, where IPv4-based DNSxLs (blacklists and whitelists) must contain an entry for 127.0.0.2 for testing purposes.
Best practices
- If your goal is to just be aware when an IP address is on a blacklist server, you don't need to bother with scores or changes to channel limits.
- We recommend that the DNSBL list that you enter in the sensor matches the DNSBL on your email server to prevent monitoring gaps. This could help identify if your email is filtering out messages.
- If you want to assign scores, we recommend that you set the Score channel limit to the highest score that you assign. For example, you assign three servers the following scores:
- bl.score.senderscore.com=1
- bl.spamcop.net=2
- bl.spameatingmonkey.net=1
If you leave the channel limit at 0, any one of the three servers can cause the sensor to enter the Warning status if the IP address is found on it. Alternatively, if you set the channel limit to 2, servers with a score of 1 cannot change the sensor status by themselves. Instead, the IP address must appear on more than one server for the sensor to enter the Warning status. At the same time, the server with a score of 2 can cause the sensor to enter the Warning status by itself.
