DNSBLOG(8postfix)

📦 version 3.8.6, in debian bookworm, ubuntu jammy, ubuntu noble

✨ DNSBLOG(8postfix) ✨

okay bestie, buckle up, we're doing a whole manual page for dnsblog — yes that's the Postfix DNS allow/denylist logger, and yes she's a real one. this page lives in the Postfix 8 manual, so like, (8postfix) is her whole last name 💅

🌸 NAME 🌸

dnsblog — Postfix DNS allow/denylist logger 🫶

🎀 SYNOPSIS 🎀

dnsblog [generic Postfix daemon options]

🦋 DESCRIPTION 🦋

so the dnsblog(8) server is literally out here implementing an ad-hoc DNS allow/denylist lookup service. that's her job. that's the whole vibe.

and ngl, the tea is: this may eventually be replaced by a UDP client that is built directly into the postscreen(8) server. so she's iconic but possibly temporary, we don't make the rules 😭

💜 PROTOCOL 💜

every single time there's a connection, the dnsblog(8) server receives:

  • a DNS allow/denylist domain name
  • an IP address
  • an ID

then it does the thing:

  • if that IP address is listed under the DNS allow/denylist → the dnsblog(8) server logs the match and replies with the query arguments plus an address list with the resulting IP addresses, separated by whitespace, and the reply TTL.
  • otherwise → it replies with the query arguments plus an empty address list and the reply TTL.

and the reply TTL? it's -1 if there is no reply, or if it's a negative reply that contains no SOA record. yes, -1. that's the signal. 👑

finally — and this is the last step, don't skip it — the dnsblog(8) server closes the connection. bye bestie 🫡

🔥 DIAGNOSTICS 🔥

problems and transactions get logged to syslogd(8) or postlogd(8). that's where the receipts live, fr fr.

✨ CONFIGURATION PARAMETERS ✨

changes to main.cf are picked up automatically, as dnsblog(8) processes run for only a limited amount of time. and if you're impatient (same), use the command postfix reload to speed up a change. lowkey a life hack.

the text below provides only a parameter summary. see postconf(5) for more details including examples — she has the full lore.

  • config_directory (see postconf -d output) — the default location of the Postfix main.cf and master.cf configuration files.
  • daemon_timeout (18000s) — how much time a Postfix daemon process may take to handle a request before it is terminated by a built-in watchdog timer. yes, there's a watchdog. she's watching. 🙈
  • postscreen_dnsbl_sites (empty) — optional list of DNS allow/denylist domains, filters and weight factors.
  • ipc_timeout (3600s) — the time limit for sending or receiving information over an internal communication channel.
  • process_id (read-only) — the process ID of a Postfix command or daemon process.
  • process_name (read-only) — the process name of a Postfix command or daemon process.
  • queue_directory (see postconf -d output) — the location of the Postfix top-level queue directory.
  • syslog_facility (mail) — the syslog facility of Postfix logging.
  • syslog_name (see postconf -d output) — a prefix that is prepended to the process name in syslog records, so that, for example, smtpd becomes prefix/smtpd. cute little name tag honestly.

🌈 Available in Postfix 3.3 and later:

  • service_name (read-only) — the master.cf service name of a Postfix daemon process.

⭐ SEE ALSO ⭐

💖 LICENSE 💖

the Secure Mailer license must be distributed with this software. not optional bestie, it's the law of the land.

🧚 HISTORY 🧚

this service was introduced with Postfix version 2.8. a whole era. an icon was born. ✨

👑 AUTHOR(S) 👑

Wietse Venema IBM T.J. Watson Research P.O. Box 704 Yorktown Heights, NY 10598, USA

Wietse Venema Google, Inc. 111 8th Avenue New York, NY 10011, USA

and that's the whole page, bestie 🫶 the footer down there just says DNSBLOG(8postfix) — the Postfix 8 manual tag, that's the source/version vibe, no date in sight, so that's all the tea we have. go forth and let the denylist know. 💅🎀

📦 where this page comes from