Issue Description
is_dnsbl() has two behaviours that lose DNSBL listings.
-
Only the first A record of a positive answer is used. A DNSBL can return several codes for one address: zen.spamhaus.org returns 127.0.0.2, 127.0.0.4 and 127.0.0.10 for its test entry 2.0.0.127. Which code is selected depends on the record order when Stalwart performs an uncached lookup, and Stalwart then caches that single code until the answer expires. The same address can therefore produce different tags across fresh lookups, while the other returned codes are never evaluated. Spamhaus documents that “Querying code is expected to go through all the A records provided by a positive reply”: Blocklists via DNS Query Requests — Spamhaus Technology Documentation 2.0 documentation
-
A not-listed answer is cached for a fixed 24 hours, regardless of the zone’s negative TTL (RFC 2308 §5). The negative TTL of zen.spamhaus.org is 10 seconds. An address listed after its first lookup is treated as not listed for up to a day.
Code (v0.16.24):
- crates/spam-filter/src/modules/dnsbl.rs L139-147: result.entry.iter().copied().next() keeps the first record only.
- crates/spam-filter/src/modules/dnsbl.rs L157-171: RecordNotFound is cached with Duration::from_secs(86400).
Expected Behavior
Every code returned for a listed address is evaluated, and a not-listed result is cached no longer than the zone’s negative TTL.
Actual Behavior
Only the first code in the answer is evaluated, so an address listed in several lists is scored for one of them, chosen by record order. A not-listed result is cached for 24 hours.
Reproduction Steps
- Through a resolver that rotates record order (Unbound with its default rrset-roundrobin yes): dig 2.0.0.127.zen.spamhaus.org A returns three records, and dig 1.0.0.127.zen.spamhaus.org A returns NXDOMAIN with an SOA minimum of 10.
- On a test instance whose DNS server answers each listed address with three codes, mapped to different tags, in rotating order: 12 lookups of distinct addresses each produced a single tag, each code 4 times.
- The not-listed result is cached for 24 hours (dnsbl.rs L169), so an address listed after its first lookup is reported not listed until that entry expires.
Stalwart Version
v0.16.x
Installation Method
Binary (Linux)
Database Backend
RocksDB
Blob Storage
RocksDB
Search Engine
Internal
Directory Backend
Internal
Additional Context
One option could be to cache and evaluate the complete positive answer, and to cache a not-listed result for the remaining negative TTL supplied by the DNS answer.
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on