Net:DNSBL & Spamhaus

[akatinic]

I'm trying to use Net::DNSBL to query Spamhaus for a web application.

I only want to query SBL and XBL, not PBL. Spamhaus says that the preferred method of doing this is by querying ZEN, then parsing the return codes to get only the SBL and XBL hits. That would be return codes 127.0.0.2 through 127.0.0.7, not 127.0.0.10 or 11, which are for PBL. But when I query ZEN with Net::DNSBL, I get only a single return code, and it appears to return the highest code on file for a given IP. Thus it would appear to be impossible to see if PBL-listed IPs are also listed on SBL or XBL.

Here is the test code I am using:

require_once 'Net/DNSBL.php';
$dnsbl = new Net_DNSBL();
$bls = array('zen.spamhaus.org');
foreach ($bls as $bl) {
  echo "$ip: ";
  $dnsbl->setBlacklists(array($bl));
  if ($dnsbl->isListed($ip)) {
    echo serialize($dnsbl->getDetails($ip));
    echo "<br>";
  } else {
    echo "OK!<br>";
  }
}

And here is a sample return (serialized getDetails) for an IP that is listed in both XBL and PBL:

a:3:{s:5:"dnsbl";s:20:"zen.spamhaus.org";s:6:"record";s:9:"127.0.0.11";s:3:"txt";a:1:{i:0;s:49:"http://www.spamhaus.org/query/bl?ip=xx.xx.xx.xx";}}

Why doesn't the result show the 127.0.0.4 code as well as 127.0.0.11? What am I missing?

Any help much appreciated,
akatinic

[coopster]

Looks like you only have a single $ip variable assigned in the loop so naturally it would only query one ip. Unless I am missing something here?

[craig1972]

Hi. I am interested in exactly the same thing, and instead of starting a new thread, I thought I'll put my question here.

Basically I am unallowed to use "pear" stuff. So I cannot use the "Net::DSBL" thing.

I am looking for very simple PHP code (or Perl) that allows me to check for domains that are in RBLs. If they are, I will save them in a DB on my end and not check them again. So hopefully the queries can be minimized.

Would anyone know any code I can pick up? I am interested in--

1. SURBL and SpamHaus Zen.

2. Both can be queried. I want to query specific host names or IP addresses, not through a mail server as they're usually used. So the code should know how to send the IP for querying (by reversing the octets) and host names (by making sure the subdomains are gone, but 2 or 3 TLDs are accurately recognized).

Thanks!