Rspamd and DNS Block Lists - DNS timeout

[Klar]

I started using rspamd and seen DNS query blocked on multi.uribl.com (127.0.0.1 returned), possibly due to high volume log messages.

From my understanding it is because I am using a "bigger" DNS resolver. Also because soft_reject_on_timeout = true; is set per default it will give a soft reject.

2024-03-26 10:56:00 #1372(controller) <imhkkk>; monitored; rspamd_monitored_dns_cb: DNS query blocked on multi.uribl.com (127.0.0.1 returned), possibly due to high volume
2024-03-26 11:10:32 #1372(controller) <imhkkk>; monitored; rspamd_monitored_dns_cb: DNS query blocked on multi.uribl.com (127.0.0.1 returned), possibly due to high volume
2024-03-26 11:20:36 #1372(controller) <imhkkk>; monitored; rspamd_monitored_dns_cb: DNS query blocked on multi.uribl.com (127.0.0.1 returned), possibly due to high volume
2024-03-26 11:31:15 #1372(controller) <imhkkk>; monitored; rspamd_monitored_dns_cb: DNS query blocked on multi.uribl.com (127.0.0.1 returned), possibly due to high volume
2024-03-26 11:45:18 #1372(controller) <imhkkk>; monitored; rspamd_monitored_dns_cb: DNS query blocked on multi.uribl.com (127.0.0.1 returned), possibly due to high volume

I would like to fix this but not sure how, three solutions I have in mind:

There is this in the documentation

If you want to see an environment variable (like RSPAMD_DNS_SERVERS) to support custom DNS servers for Rspamd being added to DMS, please raise a feature request issue.

and I could disable the [RBLs (Real-time Blacklists) / DNSBLs (DNS-based Blacklists)](https://docker-mailserver.github.io/docker-mailserver/latest/config/security/rspamd/#rbls-real-time-blacklists-dnsbls-dns-based-blacklists) as it is enabled per default.

or I could change the DNS servers via the option.conf (not sure how to do it).

I am probably not the only one with this issue, any tips?

Thanks a lot.

[glime-ai[bot]]

Please note that this response was created using generative AI, leveraging previously available information from the repository. This information may be helpful. However, it is our strong recommendation that you carefully consider the information before blindly applying it.

---

To address the issue you're encountering with Rspamd and DNS query blocks on multi.uribl.com, you have several options to consider. The log messages you're seeing indicate that the DNS queries to the URI DNS Blocklist (DNSBL) are being blocked, likely due to the use of a large, public DNS resolver which may be rate-limited by the DNSBL provider due to high volume.

Here are the options you mentioned, with guidance on how to proceed:

1. Requesting a Feature for Custom DNS Servers in Rspamd: The documentation suggests raising a feature request issue if you want to see an environment variable like RSPAMD_DNS_SERVERS added to Docker Mail Server (DMS) to support custom DNS servers for Rspamd. This would be a long-term solution that might benefit others but doesn't immediately resolve your issue.

2. Disabling RBL/DNSBL: Disabling the RBL (Real-time Blacklists) / DNSBL (DNS-based Blacklists) module in Rspamd can stop these DNS queries from being made. However, this would also reduce the spam detection capabilities of Rspamd, as these lists are a significant component of how it identifies spam. If you decide to go this route, you can do so by adjusting the Rspamd configuration files to disable the RBL module. This might not be the most desirable solution if you're looking to maintain strong spam filtering.

3. Changing DNS Servers via options.inc: Adjusting the DNS servers Rspamd uses can help if the issue is related to rate-limiting by DNSBL providers against large DNS resolvers like Google's 8.8.8.8 or Cloudflare's 1.1.1.1. To change the DNS servers, you would need to modify the options.inc file for Rspamd. This file allows you to specify custom DNS servers that Rspamd should use for its queries. The documentation does not provide a direct way to do this through environment variables or simple configuration changes in DMS, but you can manually edit the options.inc file within the Rspamd configuration directory (/etc/rspamd/ or the corresponding directory in your Docker container) to specify custom DNS servers. For example:

   dns {
       nameserver = ["9.9.9.9:53", "149.112.112.112:53"]; # Example DNS servers
   }

   This approach requires you to have access to the Rspamd configuration files within the Docker container and might involve creating a custom configuration file that you mount into the container.

Recommendation: The most immediate and impactful solution would be to adjust the DNS servers Rspamd uses by modifying the options.inc file, as this addresses the root cause of the issue without reducing spam detection capabilities. Running your own recursive DNS resolver, as suggested in some user feedback, could also be a more robust solution to avoid being rate-limited by DNSBL providers. This approach, however, requires additional setup and maintenance.

Remember to backup your configuration before making changes, and test the changes in a safe environment if possible.

This comment was generated by Glime.

[polarathene]

I am probably not the only one with this issue, any tips?

I'm a little reluctant to ping @georglauterbach each time I see rspamd related discussions as their quite busy, but since a few days have passed and they've been active in the project I'm doing so to raise awareness as this looks like it's their area of expertise in the project.

They'll chime in if they have time and any advice. I can't comment on the usefulness of the Glime response myself, but you may want to look through that as the AI has been getting better with it's advice :)

[georglauterbach]

The issue at hand is indeed connected to the fact that you're probably using public DNS resolvers (you said you're using a "bigger" resolver, which did not say which one - is it a secret? 😄). DNSBLs like SpamHaus don't like this at all and will literally just answer with 127.0.0.1.

---

The only solution to that is using your own recursive DNS server. I will shamelessly promote the container I built for this very reason myself here: https://github.com/georglauterbach/k8s-dns. Scroll down when you're on the repo's main page (viewing the README.md) and you'll see an example that covers dnswl.org and spamhaus.org. The container image was created for Kubernetes clusters but works with Docker 100% too.

In my setup, all DNS traffic in my cluster goes through coreDNS, which checks the query and forwards the request to my custom recursive resolver if the URL matches a DNSBL. This is a simple, clean and efficient way of ensuring all DNS traffic to DNSBLs is handled by the proper DNS server, and queries that don't require recursion can be handled by a fast public resolver (Quad9, Cloudflare, etc.).

If you don't want to, or you cannot point your DMS instance as a whole to another DNS server, you can use exactly what Glime suggested (I actually think Glime already gave the complete answer - I couldn't have given a more precise one when it comes to "what can you do?" myself; I think it's quite excellent):

dns {
    nameserver = ["9.9.9.9:53", "149.112.112.112:53"]; # Example DNS servers
}

This is sadly not easily done with our helper script, hence you'll either need to use user-patches.sh or mount a file yourself to /etc/rspamd/override.d/options.inc (I think).

---

@polarathene now there are many possible solutions to this problem: spinning up a proper recursive resolver and pointing Rspamd to it; spinning up a proper recursive resolver and pointing all of DMS to it (that's why @casperklein suggested); not using DNSBLs; using a "smaller" resolver (not sure of this is a good idea for the long run); getting proper API keys for the DNSBLs.

I have long thought about having an ENV like DMS_DNS_RESOLVER that configures the DNS server for all of our services, but I am not quite sure now where this is the right course. I mean, Docker and Kubernetes offer easy methods of using custom DNS servers - why should we bother?

Maybe we should remove the note I left in the docs about the feature request for setting custom Rspamd DNS servers and explain to users what I said above?

[polarathene]

I am not quite sure now where this is the right course. I mean, Docker and Kubernetes offer easy methods of using custom DNS servers - why should we bother?

I agree that we should try avoid managing DNS ourselves.

I'm ok with CoreDNS, I'm just not sure if it's another responsibility DMS should maintain as it may make troubleshooting/support more problematic based on network infrastructure outside of the container outside our control?

It's not just Docker vs K8S, as the OS can play a role too adding complexity. Linux may be using systemd-resolved, a local custom DNS service (or external one like with PiHole), VM hypervisor can influence that too IIRC, cloud vendors often use NetPlan which at least with Vultr I found annoying with it's reactive behaviour each time a container spun up introducing a new IP, VM guests resuming from suspend I was finding containers no longer could resolve DNS until restarting the Docker daemon, along with other side-effects like from kernel tunables, glibc/nss, /etc/hosts and related configs, chroot (we had a container issue related to this with Postfix back when it used chroot), Windows you've got WSL2 and it's network differences between the host, the WSL2 VM using the Docker container and the actual private WSL2 VM managed by docker, similarly macOS with it's own VM wrapper and drivers has had networking issues.

You probably won't have to worry about all that, it's more of a problem when you want to still interact with DNS elsewhere on the system. Some fairly niche but personal experiences 😓

---

Maybe we should remove the note I left in the docs about the feature request for setting custom Rspamd DNS servers and explain to users what I said above?

Your call as this is more your area I think :)

I prefer to keep maintenance simple and defer to docs until there is a well justified need by demand / benefit to integrate official support. We can only assist so far before it burdens us more than it should.

[georglauterbach]

I will remove the docs entry and add an explanation. DNS is something we want to manage or maintain, you said it just right 👍🏼

[casperklein]

Independent from rspamd, you can change the DNS server the container uses.

[Klar]

thanks for the tips.

I will have a look at hosting my own dns server, probably with the k8s-dns solution.