SURBL Servers #167

The DBL uses DNS return codes in the 127.0.1.0/24 range. Queries regarding any domain listed in DBL and all IP queries will return a response code. If no code is returned (NXDOMAIN) the domain is not listed in DBL.

DBL return codes in current and future use are:

Return Codes Data Source
127.0.1.2 spam domain
127.0.1.4 phish domain
127.0.1.5 malware domain
127.0.1.6 botnet C&C domain
127.0.1.102 abused legit spam
127.0.1.103 abused spammed redirector domain
127.0.1.104 abused legit phish
127.0.1.105 abused legit malware
127.0.1.106 abused legit botnet C&C
127.0.1.255 IP queries prohibited!
This table will be updated as specific DBL categories are added and 127.0.1.* return codes are assigned to them.

The following special codes indicate an error condition and should not be taken to imply that the queried domain is “listed”:

Return Code Zone Description
127.255.255.252 Any Typing error in DNSBL name
127.255.255.254 Any Anonymous query through public resolver
127.255.255.255 Any Excessive number of queries

Thank you - you had the cause exactly right, and it is fixed on master now (PR #244); it will be in the next release.

What was wrong. A SURBL server had no expected result at all: SURBL::Run took any A record as a listing. The Spamhaus zones (DBL, ZEN, SBL) answer a query they refuse with a code in 127.255.255.0/24 - 127.255.255.254 when the query came through a public resolver such as 8.8.8.8, .255 for too many queries, .252 for a mistyped zone - and some resolvers answer an unknown name with their own address. Every one of those counted as "listed", so on a server resolving through a public resolver every message carrying a link was tagged as spam. A DNSBL has had an expected result since the beginning; a SURBL had nothing, which is what you were asking for.

What changed.

• Each SURBL server now has an Expected result (Control Panel: Anti-spam → SURBL servers; COM: SURBLServer.ExpectedResult), in the same syntax a DNSBL uses - 127.0.1.0-255, 127.0.0.2*, ranges and wildcards joined by |. Only an answer it names is a listing. For DBL that is 127.0.1.0-255 (its codes are 127.0.1.2 to 127.0.1.106, as in the table you posted); for multi.surbl.org, 127.0.0.2-255.
• With no expected result set, any answer still counts - except the 127.255.255.0/24 refusal codes, which are never a listing. So an upgraded server loses the false positives without any configuration.
• The debug log now says what the zone answered and what was made of it, which it never did before, so a case like yours shows SURBL: ... answered 127.255.255.254: not a listing instead of a silent tag.

Two regression tests cover it (a refusal code is not a listing; with 127.0.1.0-255 expected, 127.0.0.2 is not and 127.0.1.2 is), and the schema step (6038, one column with a default) runs through the Linux build's upgrade gate on PostgreSQL and MySQL.

One thing the fix cannot change: Spamhaus refuses queries from public resolvers by policy, so through 8.8.8.8 the DBL will answer .254 for every name, listed or not. With the fix that means "no verdict" rather than "spam", but to get real DBL verdicts the server has to resolve through its own or a non-public resolver ([Settings] DNSServer points every lookup at one of your choosing).

Released: the SURBL expected result, and the refusal codes no longer counting as listings, are in 6.3.2.

"ERROR" 892 "2026-09-13 22:35:14.330" "Severity: 1 (Critical), Code: HM5011, Source: Application::OnDatabaseConnected, Description: The database is too old for this version of hMailServer. Please run hMailServer Database updater (DBUpdater.exe) to upgrade it. Database version: 6031, Required database version: 6038"

Even you run DBUpdater.exe,still error.

Update from 6.3.1 to 6.3.2