Introduction

This article describes the process of updating your DNSBL and SURBL definitions in ORF. DNS blacklist are online databases of spam sending hosts, while SURBLs are online databases of "spamvertized" URLs which are present in the email body of spam emails. Both databases are queried real time by ORF using DNS.

Having up-to-date DNSBL and SURBLs definitions in ORF and using the recommended lists are the easiest and most efficient way to catch spam. Please consult our Knowledge Base article regarding the lists we recommend.

Updating DNS Blacklist definitions

1. Download the latest definition file and extract its contents to an arbitrary folder
2. Start the ORF Administration Tool
3. Navigate to the Configuration / Tests / DNS Blacklists page
4. Right-click anywhere in the list and select Import blacklist definitions...
5. Select the blacklists.xml file that you extracted in step 1)
6. Make sure the Delete current definitions not listed here (full overwrite) checkbox is checked and click OK. You should get a DNS blacklist definitions have been imported successfully message, dismiss it by clicking OK
7. Enable the blacklists you want to use (see our recommendations)
8. Save your settings to apply the changes by pressing Ctrl + S. (In ORF 4.2 and older versions, the ORF Service needs to be restarted to pick up the changes, so press Ctrl + U instead: this saves the configuration and restarts the service in a single step).

Updating SURBL definitions

1. Download the latest definition file and extract its contents to an arbitrary folder
2. Start the ORF Administration Tool
3. Navigate to the Configuration / Filtering - On Arrival / URL Blacklists page
4. Right-click anywhere in the list and select Import definitions...
5. Select the surbls.xml file that you extracted in step 1)
6. Make sure the Full import overwrite checkbox is checked and click OK
7. Enable the blacklists you want to use (see our recommendations)
8. Save your settings to apply the changes by pressing Ctrl + S. (In ORF 4.2 and older versions, the ORF Service needs to be restarted to pick up the changes, so press Ctrl + U instead: this saves the configuration and restarts the service in a single step).

Please note that the SURBL feature is affected by a bug in pre-5.0 versions: you should either upgrade to the current latest version (recommended), or apply the workaround described under URL Blacklist Lookup Result Ignored Under Specific Circumstances on our Issue History page.