Many legitimate emails are blocked by the URI DNS Blocklist

Overview

You are observing that a large number of valid email messages are being blocked for phishing by the URI DNS Blocklist and it is unclear as to why this is happening. Some of these emails might be internal and processed by a 3rd party on your behalf.

Solution

If the steps described in the "Email was blocked by the module" section of the "How to determine why the URI DNS Blocklist spam filter blocked or allowed a message" article did not clarify, the issue may stem from an improperly configured URI DNS Blocklist.

Please follow the steps in the "How to configure the URI DNS Blocklist" article, in order to ensure the URI DNS Blocklist is functioning optimally.

Additionally, ensure that the Perimeter Servers are configured correctly so that they include all servers that relay emails to MailEssentials, and that the IP DNS Blocklist is configured optimally:

In the MailEssentials Configuration UI, navigate to Anti-Spam > Anti-Spam Filters > IP DNS Blocklist. Ensure that bl.spamcop.net and dul.dnsbl.sorbs.net are enabled. In addition, you should add the following extra list to make sure the list is configured for optimal coverage:

• Type zen.spamhaus.org in the Domain box and click Add IP DNS Blocklist.
• Type b.barracudacentral.org in the Domain box and click Add IP DNS Blocklist.
• Type dnsrbl.org in the Domain box and click Add IP DNS Blocklist.
• Type dnsbl.sorbs.net in the Domain box and click Add IP DNS Blocklist.
• Ensure the new lists are enabled and click Apply.

If the above steps have not helped, and the sender is trusted, the best way to allow these messages would be to whitelist the sender, either by IP or domain, as the blocklists are third-party libraries, and cannot be modified.

Testing

Applying the steps above will ensure that legitimate emails are no longer blocked by the blocklists.

If the issue still persists, please generate the troubleshooting logs as follows:

• Make sure that you have tracing enabled.
• Wait for at least 30 minutes to gather enough information and for the issue to be reproduced.
• Run the troubleshooter:
  1. Start > Programs > GFI MailEssentials > Troubleshooter
  2. Follow the Log Generation Wizard for collecting the required and pertinent information.
  3. Select New Case when completing the log generation to attach the logs to a new case that will be automatically created, or open a support ticket manually and attach the logs to that ticket, so that the Support team can investigate the problem.